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Baby’s Got Back! 


Welcome to the special 40th Anniversary issue of Phrack Magazine! A month 
later, we are just barely recovering from the fun at the amazingly successful 
SummerCon '92. It was the largest turnout ever seen at a SummerCon and the 
full details can be found in a special report by Knight Lightning and myself 
with help from Holistic Hacker and Dr. Williams. 


Brian Oblivion, whose name is regularly seen in the pages of Phrack returns 
with part two of his file on Cellular Telephony (part one seen in Phrack 38). 
Also relating to telephones in this issue is "The Fine Art of Telephony" by 
Crimson Flash. This equally in depth and detailed file focuses of RC/MAC, 
FACS, and MARCH. 


Even though the arrogant bastards at Southwestern Bell and BT Tymnet boast 
about their great security, it appears that they had almost nothing to do with 
the tracking down and apprehension of the MOD in New York. As a few of us 
already know, MOD was brought in by hackers. Gee, imagine that. 


I’m not going to play politics and make judgments about this, instead I’11 let 
you read all about it in Phrack World News, Part 2 and then you can draw your 
own conclusions. 


Since we’re on the subject of Tymnet, I felt it appropriate <grin> to include 

3 articles on the subject by Toucan Jones. A special "kissy, kissy" to Dale 
Drew (aka The Dictator aka Blind Faith aka Bartman) for his help and assistance 
in getting us this valuable information. Could a file on TRW be ‘round the 
corner? Hmmmmmm could be. :-) 


Starting with this issue, Mind Mage will be assisting with Phrack Loopback as 
our Technical Advisor. He will handle questions regarding technical problems 
both for publication or for private response. Feel fr to send your questions 
to phracksub@stormking.com and they will be forwarded and answered. 


This issue’s Loopback has a very special message from Jester Sluggo as he 
gives notice of his official retirement from the hacking community. Sluggo 
remembers the past and give advice about the future; I continue my pursuit on 
t 

a 

C 


he so-called professionals in the anti-virus community and exposes their real 
genda; and, Sarlo takes us on a tour of the 1992 Consumer Electronics Show in 
hicago and there is lots more. 


The Racketeer (Rack of The Hellfire Club) takes the reigns of the continuing 
Network Miscellany column and Rambone returns with the latest on what is 
happening in the underground world of computer software traders in Pirates 
Cove. 


Taran King is back for a special Phrack Pro-Phile with Lex Luthor, the founder 
of the Legion of Doom and perhaps the most legendary underground hacker ever. 


"Tf it’s older than a week, then we won’t have it online." 


You are invited to check out a great new BBS called Planet 10. If you have 
half a brain, you might even get access. Planet 10 is run by Control C and 
features messages and xfers that are timed to expire after 1 week maximum. 
Give it a call at (313) 683-9722. 
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"Phrack is a bad influence..." 
—- TriZap, July 1992 :-) 


DISPATER, Phrack Editor 
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Eleet Founders Taran King and Knight Lightning 
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==Phrack Inc.== 
Volume Four, Issue Forty, File 2 of 14 
[-=:< Phrack Loopback >:=-] 
By Dispater & Mind Mage 
Phrack Loopback is a forum for you, the reader, to ask questions, air 
problems, and talk about what ever topic you would like to discuss. This is 
also the place Phrack Staff will make suggestions to you by reviewing various 


items of note; magazines, software, catalogs, hardware, etc. 


In this issue: 


Retirement of a Hacker : Jester Sluggo 
Truth Is Out Of Style : Dispater 

Tim Foley Virus : Guido Sanchez 
The Hacker Files (from DC Comics) : Newsbytes 
Sneakers (from Universal Pictures) : Press Release 
Pirates v. AT&T: Posters : Legacy Irreverent and Captain Picard 
Telco Trashing Yields Big Rewards : Anonymous 
Anonymous Mail On IBM VM Systems? : Apollo 

WWIV Link Hack : Mr. Bigg 

The Day Bell System Died : Anonymous 

The 1992 Consumer Electronics Show : Sarlo 


Retirement 
of a 
Hacker 


by Jester Sluggo 


Released: July 9, 1992 


I would like to begin by saying "Hello" to all readers of this file, but 
unfortunately it will be my last time. I’ve been a member of the "hacker 
underground" for over a decade and am one of the few extremely lucky hackers 
who has successfully hacked a great number of computer systems, phone systems, 
and other technologies, yet has never been caught. I wish to take this last 
opportunity to reflect on my experiences, and express many personal views, 
because although there are feelings of sadness, it is my pleasure to announce 
my formal retirement from this "underground" community. 


My decision to retire has been a carefully planned path which began several 
years ago. During the early 1980’s, the innocence of hacking and exploring 
computer systems for my quest of knowledge was a great thrill. Every system 
was like an unexplored door which lead to unlimited opportunities; various 
computer systems, operating systems, languages, networks, software, and data. 


But it was in the later part of the 1980’s when I began to realize that I had 
to focus my interests, knowledge and experience towards a legitimate career. 
It’s nearly impossible to earn a living solely within the resources of the 
hacker underground, and the idea of abusing technology for monetary gain is 
against the (unwritten) code of hacker ethics. Also at this time, the 
innocence of exploring various systems was being replaced by the realities of 
ruining my entire future at such a young age if I was caught and convicted by 
the United States’ legal system. 


The media and law-enforcement agencies have almost always been biased against 
hackers, and these are two powerful entities that influence society. Hackers 
have always been presented in a negative context, whereas their discoveries, 
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efforts, creativeness, and hard work have been ignored except among fellow 
hackers. In away, it’s similar to how the U.S. government and corporations 
support research and development: A group of researchers discover, explore, 
refine, or exploit a certain technology over a period of many years, yet their 
efforts go unnoticed unless their research results in a product acceptable to 
society. The researcher’s results are shared, respected, and challenged among 
the scientific community and journals long before they ever result in a product 
(if they ever result in a product). In the same way that researchers and 
scientists relentlessly pursue their interests, I pursued answers to my 
curiosities and interests. 


It is the groups that want to control the society (the legal system, and 
police) which have labeled "hackers" as notorious people. Hackers can use 
technology to access a variety of information which was previously accessible 
only to these groups, and these controllers are afraid of losing their 
advantages and control. Currently in US, the FBI is afraid of losing their 
ability to easily tap fiber optics so they’re proposing to make it mandatory 
for central offices to make it easier for them. If people knew how common 
illegal wiretaps occur, they’d be upset at the abuse of power. Police are 
making illegal search and seizures, and district attorneys are filing 
outrageous affidavits to protect their control of power and access to 
information. 


It was in the middle to late 1980’s when the legal system and law enforcement 
agencies increased efforts to severely penalize hackers, when the risk of 
getting caught began to outweigh the excitement of discovering. It is 
unbelievably difficult to carry the burden of a "serious" criminal record 
throughout one’s life when you’re 20 years old (or for that matter 16 years 
old), as well as the eternal monetary debt which comes with these consequences. 
In the 1970’s, the founders of Apple computer were caught selling Blue Boxes 
while they were in college and got off with a minimal fine. With todays laws, 
the potential jail time, monetary damages, and lawyer fees, the system would 
h 
Cc 
t 


ave wasted and banned the brilliance of Steve Wozniak and Steve Jobs. Apple 
omputer (and microcomputers) might not have been born (IBM would have loved 
hat). 


Technology has changed faster than the legal system and society can adapt, so 
for now, unapproved exploring of these technologies has been declared a serious 
offense. Society trusts the legal systems’ judgement, but even in 1992 law- 
makers are just barely beginning to understand technology: "Is software 
patentable (do not confuse with copyrightable), and to what degree?", "What 


privacy and freedom of speech should we have with electronic mail and 
communications?" Don’t let unqualified law makers make decisions about 
technology-related issues that will affect you, without them knowing what you 


have to say. 


So it was in the late 1980’s when I began preparing for my retirement. I 
outlined a set of goals and a plan to achieve them. Unfortunately this plan 
required several years to fulfill, but I knew it was the right time of my life 
to begin this ambitious plan. The goals I wanted to achieve were: 


1) Pass the knowledge I’ve gained onto others. 

2) Keep the "hacker" movement active. 

3) Prepare myself to be legitimately successful so that I can help to 
influence society’s views about technology as a member of the 
society. 


Due to the increasing danger of getting caught, and to become successful, I 

was forced to hide from the mainstream hacker community and make my actions and 
efforts unknown. The first two goals were closely related and took slightly 
longer to complete than my original plan. However, they were a much greater 
financial sacrifice than I ever imagined. The third goal will probably require 
the rest of my lifetime, but it’s a challenge I accept. 


To complete goals 1 and 2, I’ve spent the last 5 years preparing a "tomb" of 
information and knowledge used within the hacker community. Not all of the 
information is complete, but neither is the seed that grows to become a tree. 
Anyone with a telephone can guess ("hack" according to the media and law 


2.txt Wed Apr 26 09:43:39 2017 3 


nforcement) 4-digit passwords to telephone calling cards or PBX out-dial 
lines, but I wanted "real" hackers. I talked and met with 100’s of hackers 
world-wide to find the right individuals who can responsibly learn and append 
to this "tomb" -- people who have the desire, respect, ffort and ability to 
encourage new generations of hackers. This group has been selected and 
trained, and I feel they are some of the best prospects. Their international 
mixing should give them an almost unlimited number of opportunities, and some 
protection. I wish them the best of all luck in their endless journey of 
learning and knowledge. 


[To become legitimately successful meant getting a respectable job. Obviously, 
with my interests, I knew it would have to be in the high technology 
industries. Unfortunately, getting a job interview or a job offer with these 
companies is difficult because the Human Resources departments always shun the 
hiring of hackers. This is ironic, because many of the engineers and 
programmers within these companies are made of ex-hackers, or people who share 
a Similar intense interest in technology. Also, since some of best experiences 
of a hacker are discovered non-legitimately they can’t be presented on a 
resume. 


My first step towards completing this goal was instinctive; to keep my 
excitement and enjoyment focused intensely on technology. This may sound 
strange, but many hackers know friends who "burn out" on hacking or working 

in the high-tech companies, and I didn’t want to ’burn out’ at 20 years of age, 
so I had to slow down my hacking activity. 


The next step was getting a college education, which I’ve completed. College 
is not the answer to everything... in fact it’s not the answer to anything, 
however, college is an experience I wish everyone could experienc it’s a 
unique experience. A college degree will not guarantee a job, but it might get 
you past the Human Resources department. If you have the chance to attend 
college, don’t miss this chance. I realiz mployers prefer experienced 
workers over inexperienced "fresh" college graduates, but if you have a focused 
interest on a certain technology, then you will find a way to keep updating 
yourself while suffering through college. And like me, you will find the 
college degree combined with the results of your focused efforts will open the 
best job opportunities to you. Be focused and patient... it worked for me! 


I am currently working on the inside of a technology-related company, enjoying 
the work I do for a living. In fact, sometimes I think to myself, "Wow, I get 
paid for doing this!?" It’s a thrill to be doing what I do, yet I must work 
hard, and continue working hard to achieve the highest position I am able to 
reach to make the most of my abilities. In doing this, I hope someday to give 
something back to the non-hacking society which may show them that hackers are 
constructive to society, thus, changing their negative view which has labeled 
hackers synonymous to "criminals." I would like to see mature, legitimately-— 
successful hackers, form an interest group to help cultivate the energy of the 
younger hackers. 


Although I am retiring from the community, I can never retire the curiosity and 
intense interest I have about technology. Instead, I now focus these aspects 
legitimately into my daily work and will continue to do so. I’ve immensely 
enjoyed my involvement in the hacking community and will always treasure it. I 
also hope to eventually persuade people to accept hackers and to not persecute 
them. This last goal is the most ambitious goal, but I feel it’s the most 
important goal, because those groups that control society are wasting a group 
of young and talented individuals who could be inventors of future 
technologies. Now, I will formally say "goodbye" to my friends in the hacking 
community... but not for the last time. 


Persevere, 


Jester Sluggo 


"Truth Is Out Of Style" 


An Investigative Report Into Computer Security Corruption 
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by Dispater 


It seems that these days the anti-virus industry/community has brainwashed the 
public into thinking that any use of a modem will put you in contact with an 
unfathomable array of dangers. It sounds like something your mom said, when 
she didn’t want you to stay out after dark doesn’t it? 


As it turns out the anti-virus community has all the moral fiber of television 
evangelists. As they preach on about the horrors of accessing information 
(without purchasing one of their products), they are engaging in the activity 
that they claim should be made a federal offense, in Congress. That is the 
"distribution of computer viruses. Not only have they been involved in this 
type of activity since they industry began, but now there is a self proclaimed 
"elite" [smirk] group of so-called professionals within the industry that wish 
to keep a monopoly on the virus trade, by ruining the reputation and lives of 
independent researchers. So in away, we now have a "virus cartel" within the 
computer security industry. 


The Little Black Book of Computer Viruses 

The Little Black Book of Computer Viruses is a printed text that has been 
around for a few years, but is finally making waves with people who think 
Prodigy and CompuServe are the best networks ever invented. Anyway, this book 
contains printed out versions of viruses. Gee, viruses are SO difficult for 
people to get their hands on aren’t they? Well, one of the information 
dinosaurs got his name in print for condemning such immorality. 


"Professional virus fighters such as Alan Solomon at S&S 
International are madder than angry hornets over the publication. 
They are encouraging anti-black book campaigns that include 
PICKETING THE AUTHOR’S HOUSE, boycotting shops that sell the book, 
petitioning Congress, and even bringing in lawyers." 

—-- ComputerWorld, June 29, 1992, page 4 (emphasis added) 


Well isn’t it interesting to note that while Mr. Solomon is encouraging 
personal and economic harassment of Mr. Ludwig, his close friend and business 
associate, Sarah Gordon is doing the dirty work for him. 


The National Computer Security Association’s lst Annual Conference on Viruses 
took place in Washington, D.C. this past June. Alan Solomon and Sarah Gordon 
were there in full force. Gordon has often been referred to as being Solomon’s 
sidekick and nowhere did she live up to this distinctive title more than at 
this conference. 


At the conference, Gordon purchased not one, but two copies of Ludwig’s book 
and then immediately ran to the conference organizer to make a dramatic scene 
over how immoral it was for Mr. Ludwig to be selling such a thing. As it turns 
out this is not the first time Sarah Gordon has engaged in such hypocritical 
behavior. 


Another interesting thing to note at the conference is the fact that one 
evening, Knight Lightning and a couple of others noticed some people sitting 
around a room and walked in out of curiosity to what was going on. As it 
turned out what was going on was a "midnight meeting" of sorts. KL and friends 
were asked to leave because "it was not appropriate that <they> be here." Why 
wasn’t it appropriate? It’s because what these people were doing was 
discussing the ways they were going to "take down bulletin boards" and damage 
people’s career’s who distribute viruses. 


Sometime after this conference, I learned about their plan to use "the media to 
ruin these sysops. For example, to use influence with the media to call 
attention to this type of activity." These peopl ven went so far as to 
compile a list of BBSes that they wish to "take down." 
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The Hit List 


Phrack received anonymous mail 
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containing the BBS 


"Hit. List” 


that the self- 


proclaimed "elite" group of modem vigilantes put together to target first. 


Upon our receipt of this 
these boards and as a result, 


+1-206-481-2728 The Fe 


+1-213-274-1333 
1-213-274-2222 
+1-213-PRI-VATE\ 


West C 
DII 


+1-ITS-PRI-VATE/ 
+1-301-PRI-VATE\ 


E 


1-301-913-5915/ 
1-301-948-7761 


Corner 


[ 


1-305-669-1347 
+1-516-466-4620\ 


+1-517-PRI-VATE/ 


softwa 


many of t 


called Custom 
oast Technologies 


stering 


) BBS-A-Holic 


)Digital Underground 


stone III 
] 


The Penthouse 


)Hamburger Heaven: 


re problems, 


+1-602-491-0703 The Final Frontier 
+1-708-541-1069 Pirate’s Guild 
+1-717-367-3501 Night Eyes 
+1-818-831-3189 Pirate’s Cove 
+1-901-756-4756 Silicon Central 
+1-916-729-2112 The Welfare Department 


Pit of Vile 
This phone number belongs to a construction company 
Building Co.] 
(Tymnet 311021300023) 


+1-213-274-1333 
+1-213-274-aaaa 
+1-313-LIM-ITED 
+1-409-372-5511 The Cr 
+1-514-PRI-VATE\ 


DII 


)The Sa 
+1-514-975-9362/ 


+1-516-541-6324 Realm 
+1-708-459-7267 Hell P 
+1-713-464-9013 South 
+1-818-831-3189 Pirate 


+1-819-PRI-VATE 


Canterbury Woods 


owbar Hotel 


cred Reich 


+1-516-328-0847 The Grave of the Lost 


of Heroes 
ase 

of Heaven 
'"s Cove 


Brain Damage 


Excretions 


this was down for 
was titled Sentinel’s Gate 


list, Phrack staff members contacted the sysops of 
] he numbers have since been changed. 


[This is an insurance companies phone number] 


West Coast Technologies (Tymnet 311021300023) 


It is unclear as to whom is directly responsible for the organization of this 
group or who is responsible for creating and distributing the list, 


ther 


wer 


representatives from CERT, 


ISPNews, 


and several other wel 


however 
ll known 


individuals who are self-proclaimed security experts as well as a sl] 
nobodies who wish to make a name for themselves. 


The Hell Pit BBS 


lew of 


The Hell Pit is a BBS system in Chicago and operated by a sysop named Kato. 


Kato has a legitimate curiosity 
the inner-workings of viruses. 


"I have been running The Hell Pit BBS for the past 3 years. 
through many phases in that time, 


for computer viruses. I bec 


(as if a curiosity needs to be validated) 
let him relat 


I shall 


his 


about 


years ago and I set up a virus fil 


mere 5 or 6 viruses that I h 


am 


At first 


collection has grown to about 700 IBM computer viruses." 


xperienc 


It’s gone 

but the most recent has been my affection 
interested in viruses about one and a half 
le base on my system. 
ad collected from a system in the area. 


I hada 
My 


"It seems to be their objective to shut down my bulletin board system and 


therefore eliminate my virus 


database. 


Considering these anti-virus 
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personnel claim to be interested in aspects of computer security, I find 
their tactics highly questionable. There was recently a NCSA anti-virus 
conference. I learned from sources that one of the people attending the 
conference [Sarah Gordon] had committed certain acts on my BBS. This person 
claimed to have called up, uploaded 3 fake viruses, gained access to my 
virus database and then downloaded several viruses. This is their proof 
that I do not adequately control virus access on my system. The anti-virus 
personnel do not allow me to defend myself." 


"Anti-virus personnel themselves have committed the same mistakes as I did, 
probably much more often. There is no set of rules that determines what 
makes someone an anti-virus authority. Certain people that seem to fit the 
mold are allowed to exchange viruses with anti-virus personnel. What are 
the criteria for these people? Is there any? It has been my experience 
that if you get involved with the right circles, you are considered an anti- 
virus authority. However, there are many places in the anti-virus community 
for viruses to leak out. For one thing, you can never be certain who you 
are dealing with. Just because someone is smart and claims to hold an anti- 
virus attitude is no guarantee that that person isn’t an "in the closet" 
virus writer. 


"At anti-virus conferences such as the NCSA anti-virus conference, guests 
were exchanging viruses like they were baseball cards. That isn’t what I 
would consider controlling access." 


"They do help a lot of people with computer troubles. However, to criticize 
me for not properly controlling access to my collection of viruses is being 
hypocritical." 
"If anyone would like to call my system to check things out, feel free. I 
have a lot more to offer than just computer viruses. I have a good number 
of text files and some pretty active message bases. The Hell Pit BBS - 
(708) 459-7267" — Kato 

Conclusions 


It seems there is a move afoot in the anti-virus community to rid the world of 
bulletin board systems that disseminate viruses openly and freely. The anti- 
virus professionals believe that they must "defend the world" from this type of 
activity. Even though during a recent conference in Washington, D.C., it was 
disclosed that an anti-virus researcher recently uploaded three (3) viruses 
onto a virus BBS (Hell Pit). Why was this done? To "expose the fact that the 
sysop was not as careful as he claims to be." The person that did this was 
then able to download viruses which was against the policy the sysop claimed 
was in place (of course this statement is based upon the integrity of the anti- 
virus community and their integrity is obviously suspect). 


So, the anti-virus community set-up this sysop and made an example of him in a 
national conference without allowing him the opportunity to defend himself. In 
fact, the sysop may still be totally unaware that this event has even occurred, 
until now that is. 


These anti-virus researchers were openly exchanging copies of viruses for 
"research purposes only." It seems okay for them to disseminate viruses in the 
name of research because of their self-proclaimed importance in the anti-virus 
community, but others that threaten their elite (NOT!) status are subject to be 
framed and hav xamples made of them. 


Do As I Say, Not As I Do 

This type of activity raises a very interesting question. Who gives private 
sector computer security employees or consultants carte blanche to conduct this 
type of activity? Especially when they have the gall to turn around and label 
hackers as criminals for doing the exact same thing. The answer is not who, 
but what; money and ego. Perhaps the most frightening aspect of this whole 
situation is that the true battle being fought here is not over viruses and 
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bulletin board systems, but instead the fr dissemination of information. For 
a group of individuals so immersed in this world, there is a profound ignorance 
of the concepts of First Amendment rights. 


Phrack Magazine is ready to stand tall and vigorously keep a close watch and 
defend against any incursion of these rights. We’ve been around a long time, 
we know where the bodies are buried, our legion of followers and readers have 
their eyes and ears open all across the country. Those of you in the security 
industry be warned becaus very time you slip up, we will be there to expos 
you. 


Dispater 


Tim Foley Virus 


By Guido Sanchez 


Right after I moved from 512 to 708, I had the misfortune to realize that Steve 
Jackson Games, a company whose games I readily buy and play, had a BBS up in my 
home town called the Illuminati BBS. This was my misfortune as I could have 
called it locally in Texas, but now instead had to spend my phone bill on it 
from Illinois. 


A good year after the Secret Service assault of Steve Jackson Games, after most 
of the "evidence" was returned with nifty little green stickers on it, a text 
file was put up on the BBS called FOLEY.TXT, a simple copy of the lawsuit that 
Steve Jackson Games had filed against the government, also known as 
JACKSUIT.TXT, distributed by the EFF I believe. 


[Editor’s Note: We have been unable to confirm that EFF ever released a file 
called JACKSUIT.TXT, however details of the EFF’s 
participation in the Steve Jackson Games lawsuit can be found 
in EFFector Online 1.04.] 


It was called FOLEY.TXT obviously because of Timothy Foley, a big-shot 
government guy [actually an agent for the U.S. Secret Service] who is one of 
the defendants in the case. I downloaded the file, and zipped it into a file 
called, surprisingly enough, FOLEY.ZIP. 


Within the next week, I was gleefully spreading information as usual, and 
uploaded the FOLEY.ZIP file along with a batch of viral files to a local BBS 
with a beginning virus base. The theory here is to spread viruses about, 
accessible to all so that wonderful little Anti-Viral programmers cannot 
succeed. 


Unfortunately, the FOLEY.ZIP file was put into the viral file base, and before 
I could warn the sysop to move it into the appropriate file base, about 8 lame 
warezwolves had downloaded it and by the end of the week it was widely spread 
around the 708 NPA. 


The moral of this story? None really, it’s just an amusing vignette of what 
can happen when people become involved in the intense bartering of information 
that takes place via modem, and can get ridiculed if they’re not sure of their 
commodity. That’s all this huge business is, everyone is a courier. Whether 
they’re pirated files, adult files, sound files, viruses, or text files; 90% of 
the time they’re just downloaded from one 1.2 gig board and uploaded to the 
next one for more credits to download more files, etc. 


It’s a great big cycle, just like life. So, to risk sounding cliche, my rally 


to all is this: "Slow down! Sit back and pick the roses, eat them, digest them, 
and eventually <hopefully> excrete them!" Mr. Warhol, my fifteen minutes are 
up. The soapbox is now free. 

The Hacker Files June 22, 1992 


By Barbara E. McMullen & John F. McMullen (Newsbytes) 
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NEW YORK -- DC Comics has announced the introduction of a new twelve-issu 
series, "The Hacker Files." DC spokesperson Martha Thomases said that the 
first issue will ship on June 23rd. 


The series, created by science fiction author Lewis Shiner, deals with the 
adventures of "super-hacker" Jack Marshall who, prior to the events chronicled 
in the series, unjustly lost his job at Digitronix and now operates as a free- 
lance consultant. 


The first story line, covering the first four issues of the series, deals with 
Marshall’s attempt to uncover those responsible for jamming ARPANET (Network of 
Advanced Research Projects Agency) and causing NORAD’s Space Surveillance 
Center inside Cheyenne Mountain, Wyoming to malfunction, bringing the United 
States to the brink of nuclear war. 


In the course of his investigation, Marshall, AKA "Hacker," is assisted by a 
number of members of the hacker community -- "Master Blaster," "Sue Denim," and 
"Spider" (Master Blaster, whose real name is Mikey is a student at New York 
City’s Bronx High School of Science). 


Fiction comes close to reality when it appears that the person responsible for 
the virus that caused the damage is Roger P. Sylvester, a student at Columbia 
University and the son of a high ranking official at the National Security 
Agency (NSA); on November 2, 1988 Robert T. Morris, Jr., a Cornell student and 
s 

t 


on of NSA’s chief computer scientist, caused the crippling of the Internet 
hrough his release of the "Internet Worm." 


Shiner told Newsbytes, "The similarity of the characters was, of course done 
intentionally -- you might even note the somewhat subtle connection of the 
names: ‘’Sylvester The Cat’ and ’Morris The Cat.’ I did it partially to show 
t 

W 


hose somewhat knowledgeable about computers that the plot was not made out of 
hole cloth but was the result of a good deal of research." 


Shiner continued, "When reading comics, I look for information density and I 
tried to make the Hacker Files rich in that regard. I’m hoping to attract some 
computer-literate young people to comics -- comics were one of the earliest 
forms of expression to make great use of computers and I hope, with the Hacker 
Files, to involve more computer types in the medium." 


Shiner also told Newsbytes that his experience as a programmer with a small 
Dallas software firm provided him with an ongoing interest in computer and 
communications technology. He added, "The firm was sold to EDS (Electronic 
Data Services), Ross Perot’s firm, and, with long hair and jeans, I didn’t fit 
into the EDS mold so I left and concentrated on writing." 


"Sneakers" by Universal Pictures June 24, 1992 


Taken from PR Newswire 


Follow A Team of High-Tech Security Experts 
Into The Complex World of Computer Crime 


"I was trying to break into Protovision. I wanted to get the programs for 
their new games." David Lightman (Matthew Broderick, "WarGames"). 


"The world isn’t run by weapons anymore, or energy or money. It’s run by 
little ones and zeros. Little bits of data. It’s all just electrons." —-- 
Cosmo (Ben Kingsley, "Sneakers"). 


In 1984, screenwriters Walter F. Parkes and Lawrence Lasker received an Academy 
Award nomination for their script which followed the adventures of a young high 
school hacker (Matthew Broderick) whose computer made contact with the 
mainframe computers at North American Air Defense Command (NORAD) . 


A critical and box office success, "WarGames" was the first major motion 
picture to explore th merging worlds of computer games, hacking, crashing and 
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data piracy. It soon found a legion of fans who had also discovered the vast 
frontiers available through their personal computer. 


Eight years later, Parkes and Lasker along with writer-director Phil Alden 


Robinson ("Field of Dreams") have collaborated on "Sneakers," a Universal 
Pictures release which follows a team of high-tech security experts into the 
complex world of computer crime. The caper film, directed by Robinson, stars 


Robert Redford, Dan Aykroyd, Ben Kingsley, River Phoenix, Sidney Poitier, David 
Strathairn, James Earl Jones, and Mary McDonnell. 


Parkes and Lasker first heard the term "sneakers" at a computer convention in 
1981 as a nickname for IBM’s kid programmers. Months later, they met th 
editor of a small computer magazine who had a very different definition of the 
word. "Sneakers," their source explained, is a term that is synonymous with 
"black hatters" and "tiger teams," or individuals who are hired to break into 
places in order to test the security of the installation. 


Teaming up with Robinson, the trio wrote the basic outline of a story about a 
team of sneakers whose questionable pasts had brought them together. Robinson 
then embarked on som xtensive research, but what had begun as basic fact- 
finding about computer outlaws soon evolved into clandestine meetings with 
underground hackers, FBI men, cryptologists, wire tappers, professional 
penetrators and an endless stream of cyberpunks who were the pioneers in system 
break-ins. 


The "Sneakers" research led to meetings with numerous characters, ranging from 
the notorious Captain Crunch (John Draper) to renowned mathematician Leonard 
Adelman, called the father of public-key encryption. Using computer 
encryption as a plot device, the writers were able to concoct an intricate 
"what if" story which explored the possibility of a "black box" that could 
potentially crack the code of any electronic information in the world. 


"’Sneakers’ has to do with a new age... the information age," said Redford. 
"It’s quite possible that a war in the future will be a war of information. 
Whoever has it, wins." 


Coming to theaters this September. 


Pirates v. AT&T: Posters 


Special thanks to Legacy Irreverent and Captain Picard 


On May 24 1992, two lone pirates, Legacy (of CyberPunk System) and Captain 
Picard (of Holodeck) had finally had enough of AT&T. Together, they traveled 
to the AT&T Maintenance Facility (just west of Goddard, Kansas) and claimed the 
property in the name of pirates and hackers everywher 


They hoisted the Jolly Roger skull and crossbones high on the AT&T flagpole, 
where it stayed for two days until it was taken down by security. 


This event was photographed and videotaped by EGATOBAS Productions, to preserve 
this landmark in history. And now you can witness the event. For a limited 
time they are offering full color posters and t-shirts of the Jolly Roger 
Pirate flag flying high over AT&T, with the AT&T logo in plain view, with the 
caption; "WE CAME, WE SAW, WE CONQUERED." 


Prices: 74™ s¢ 17" Fuld. ‘Color posters a4.nacey Wee es Hele le ot Soe cet $ 7.00 US 
20" x 30" Full Color poster $20.00 US 
T-shirts $20.00 US 


If you are interested in purchasing, simply send check or money order for the 
amount, plus $1.00 US for postage and handling to: 


CyberPunk System 
P.O. Box 771027 
Wichita, KS 67277-1072 
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Be sure to specify size on T-shirt. 


A GIF of this is also available from CyberPunk System, 1:291/19, 23:316/0, 
72:708/316, 69:2316/0. FREQ magicname PIRATE 


Telco Trashing Yields Big Rewards July 20, 1992 


by Anonymous 


A few days ago, I was faced with a decision about what to do that fine evening: 
Try and make amends with my girlfriend or go dumpster diving down at the Bell 
Central Office. Well I guess I am a true lamer since I opted for the telco, 
but my choice did not go unrewarded as I found a nice little treasure. 


The building is a old 1940’s brick place with almost no security whatsoever, 
not even a guard on Sunday nights. So, it was no problem to jump the barbed 
wire fence that surrounded the truck lot where the dumpster was located. After 
rooting around through the dumpster for something worth my while, I came across 
a medium sized box that apparently had been used by one of the employees for 
moving since written on the were the words "pots and pans, kitchen." 


Naturally intrigued by this strange box in a telco dumpster, I opened it and 
found quite a surprise! There, staring up at me, was a binder with a label 
stuck on it that read "Phrack 23." Inside I found th ntire collection of 
Phrack 1-39, Informatik 1-4, and LOD/H Technical Journals 1 and 2 (apparently 
they were too cheap to print out the rest). They were poorly printed ona 
laser printer (or well printed on a ink jet), but they were much better than 
the cheesy job I had done printing out mine. 27) 


Apparently someone at the telco is a phreaker that infiltrated the ranks of 
South Central Bell or they have been reading up on the latest and greatest in 
the phreaker/hacker community. 


Perhaps not as valuable as a list of COSMOS passwords or dialups, but still it 
was quite a find. 


Anonymous Mail On IBM VM Systems? 
Date: Tue, 28 Apr 92 14:54:58 EST 
From: Apollo 
Subject: Anonymous Mail 
To: Phrack Staff 


Dear Phrack Staff, 

I was reading a past Phrack issue and noticed that you can send anonymous 
mail from a UNIX system. I know that there is a way to send it from a VM 
system. However, the people at my node don’t want anonymous mail sent, so they 


do not tell us how it’s done. Can someone PLEASE tell me how I can send 
anonymous mail via a VM system? 


-- Apollo -- 


From: Mind Mage 
Subject: Anonymous Mail 
To: Apollo 


I assume that you know you can telnet to any VM system on the Internet and send 
anonymous mail using port 25 and a commands that are very similar to that of 
the UNIX SMTP. 


If you want to send it from your particular system, you can try telneting to 
port 25 of your own machine and doing it from there. 


Mind Mage 
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WWIV Link Hack 


By Mr. Bigg (Rebel-*-Jedi) 


Not that many people care but here is a nice little trick I happened to come 
across and feel like sharing. 


Hack for WWIV Systems Using Multi-Net v1.0 Mod 
Usually used for LinkNet 


Main Login: @-!NETWORK!-@ 

ink Login: 1 (or whoever is sysop) 
//edit config.dat 

find system password in file 

abort editing 

//dos 

enter system password 


Viola, access to Dos :) 


Lamely enough there is no password. Check for users when using this mod. 


The Day Bell System Died 


Sung to the tune of American Pie (with apologies to Don McLean) 


Long, long, time ago, 
I can still remember, 
When the local calls were "free". 
And I knew if I paid my bill, 
And never wished them any ill, 
That the phone company would let me be... 


But Uncle Sam said he knew better, 
Split ’em up, for all and ever! 
We’1l foster competition: 

It’s good capital-ism! 


I can’t remember if I cried, 

When my phone bill first tripled in size. 
But something touched me deep inside, 

The day... Bell System... died. 


And we were Singing... 


Bye, bye, Ma Bell, why did you die? 

We get static from Sprint and echo from MCI, 
"Our local calls have us in hock!" we all cry. 
Oh Ma Bell why did you have to die? 

Ma Bell why did you have to die? 


Is your office Step by Step, 

Or have you gotten some Crossbar yet? 

Everybody used to ask... 

Oh, is TSPS coming soon? 

IDDD will be a boon! 

And, I hope to get a Touch-Tone phone, real soon... 


he color phones are really neat, 
nd direct dialing can’t be beat! 
y area code is "low": 
he prestige way to go! 


A 
M 


Oh, they just raised phone booths to a dime! 
Well, I suppose it’s about time. 
I remember how the payphones chimed, 
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The day... Bell System... died. 


And we were Singing... 


Bye, bye, Ma Bell, why did you die? 

We get static from Sprint and echo from MCI, 
"Our local calls have us in hock!" we all cry. 
Oh Ma Bell why did you have to die? 

Ma Bell why did you have to die? 


Back then we were all at one rate, 
Phone installs didn’t cause debate, 
About who’d put which wire where... 
Installers came right out to you, 

No "phone stores" with their ballyhoo, 
And 411 was free, seemed very fair! 


But FCC wanted it seems, 

To let others skim long-distance creams, 
No matter ’bout the locals, 

They’ re mostly all just yokels! 


And so one day it came to pass, 

That the great Bell System did collapse, 
In rubble now, we all do mass, 

The day... Bell System... died. 


So bye, bye, Ma Bell, why did you die? 

We get static from Sprint and echo from MCI, 
"Our local calls have us in hock!" we all cry. 
Oh Ma Bell why did you have to die? 

Ma Bell why did you have to die? 


I drove on out to Murray Hill, 

To see Bell Labs, some time to kill, 

But the sign there said the Labs were gone. 

I went back to my old CO, 

Where I’d had my phone lines, years ago, 

But it was empty, dark, and ever so forlorn... 


No relays pulsed, 

No data crooned, 

No MF tones did play their tunes, 
There wasn’t a word spoken, 

All carrier paths were broken... 


And so that’s how it all occurred, 
Microwave horns just nests for birds, 
r 


Everything became so absurd, 
he day... Bell System... died. 


So bye, bye, Ma Bell, why did you die? 

We get static from Sprint and echo from MCI, 
"Our local calls have us in hock!" we all cry. 
Oh Ma Bell why did you have to die? 

Ma Bell why did you have to die? 


We were Singing: 


Bye, bye, Ma Bell, why did you die? 

We get static from Sprint and echo from MCI, 
"Our local calls have us in hock!" we all cry. 
Oh Ma Bell why did you have to die? 


The 1992 Consumer Electronics Show 


By Sarlo 
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The Consumer Electronic Show is the annual event held in Chicago, Illinois, 
that gives a sneak peek at the electronic products to come to market, as well 
s products that are currently on the market. 


fe) 


he show is usually closed to the public. This year however, for a MEASLY $10 
ee, the common shmoe can waltz his ignorant ass right up to the door, get a 
reen stamp on his hand, and walk up to several displays, oohing and ahhhing, 
nd gape like landed fish at the wonderous booths set up by various 
articipating companies such as AT&T, most major bell companies, IBM, Prodigy, 
ozens of cellular manufacturers, Nintendo, Sega, and more software producers 


han I really have the patience to list. 


tate VQ hH 


I take a taxi to the McCormick center, a convention haven, and enter through 
the underground entrance. I walk down the nondescript hallway, noting that for 
a center that is supposed to be housing the latest in the future technology, 
nothing was that awe-inspiring. Expecting a lame show with shoddy video 
graphics, I purchased my ticket, got my hand stamped and entered the doors. 


Into an enormous room, filling my senses with an array of Lights and Sound. 

You could almost smell the silicon as I made my way down the aisle displaying 
the giant Phillips Digital Compact Cassettes screen. Not being a huge fan of 
stereo equipment, I head over to the Sharp Electronics Display. It was a turn 
in the right direction, as it brought me face to face with one of the clearest 
and, per the name, sharpest video displays I have seen in my life. Their LCD 
big-screen televisions, displaying a aquarium scene. Even close up, distortion 
of the images were at a minimum. Along the north wall, a smaller, gutted 
version of the LCD display was shown, giving electronics buffs a firsthand look 
at the inner workings of the viewscreens. Turning a corner, I came face to 
face with their dual-projection wallscreen television. Instead of ghost images 
and a fuzzy, indistinct picture, I found that it may have very well be th 
highest quality video projection system I have ever come in contact with. 


Cellular Mania 


The highlight of the Cellular Phone section was the Motorola Cordless/Cellular 
display area with a large sign showing the spokesperson for Motorola, the eye- 
catching slogan above him: 


"Cordless Phone Eavesdroppers Are Everywhere." 


Immediately catching my interest, I wandered over to check out the smaller 
print: 


"But with my Motorola Secure Clear (tm) Cordless Phone, my private 
conversations stay private." 


Secure Clear, as the literatur xplains it, is an exclusive technology that 
assures you that no eavesdroppers will be able to use another cordless phone, 
scanner or baby monitor to listen to your cordless conversations. 


As most of us know, security codes and multi-channels don’t always prevent 
eavesdropping. With the latest technology these days, security codes, one of 
65,000 possible codes that are randomly assigned every time you set the handset 
into the base, keeps someone from using your phone base as an outgoing 
phoneline. 


Using the Auto Channel Scan (ACS), the Secure Clear Cordless Phones 
automatically skip any channels that register noise or interference. Three 
guesses what Sarlo is getting himself for Christmas. 


For more information on this or any other Motorola product, call their Consumer 
Products Division at (800) 331-6456. 


On other notes, Technophone had a wide variety of cellular accessories, 
including a Desk stand, spare batteries, an in-car charger, a new life of 
antennae, QuickCharge AC chargers, and a hands-free unit for safe operation in 
a car. 
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Omni Cellular had one of their Model "A" V833k Portable Hand-Helds open for a 
demonstration, giving a static-free conversation with one of the salesmen. 
Many of the features of this phone were: 


o 90 Minutes of Talk Time 
o 10 hours of Stand-by Time. 
o and a sturdy design built right here in the USA. 


Other features included Auto-Power Shutoff, Electronic Lock, 50 number memory, 
and signal strength indicator. 


East Building Hipster Hi-Jinx 

Growing bored, I headed over to the map. Searching it, I found, almost 
literally, my green light. On their illuminated map display, the green section 
of the map beamed out to me. 


"Computers" 


Hauling ass to the door, stopping for a quick inspection of my bags by the 
security guard, I strolled over to the east building (purchasing a way-keen 
CES-92 T-Shirt along the way), I burst into the building with a renewed vigor. 


Right smack-dab in the front of the entrance there is the awful stench of men 
in business suits and cheap computer services. Right away, I knew I had found 
the Prodigy display. 


With free trials and the salesmen prodding the consumers to subscribe to their 
system, I decided to take a look. 


"Where else can you get such a great service, allowing you access to such a 
wide variety of things such as an online message service, up-to-date news, an 
online encyclopedia, and thousands of interesting users, people just like 
yourselves?" The Online-Conman peddled his wares to the unsuspecting 
consumers, not only misinforming them as to think that Prodigy is a useful 
service at all, but to actually have the gall to shove a PS/1 in their faces 
and tell them it’s a quality computer. 


"Umm... what about any Public Access Unix Site with an Internet or Usenet 
feed," I asked. The clod then got on his high-horse and addressed me. 


"Perhaps. But most Public Unix’s, or bulletin boards, for that matter don’t 
have high-quality graphics to accompany the information." The man had 
definitely done his homework. But apparently IBM and Sears soaped the man’s 
brains out thoroughly enough to the point where he actually bought the bull 
that they were forcing down peoples throats. 


"Yea," I said. "But most public access sites don’t waste a quarter of your 
screen space with worthless advertisements. I wasn’t aware that pretty 
pictures made the news or messages any more informative, either. But I might 
also point out that they don’t charge you a extra amount of money for every 
message over the 30th one, read your mail or censor your public posts, or, many 
times, even charge you a fee at all, other than possibly an optional 
subscription fee, around $50 a YEAR at most, nor do they have small datafiles 
that collects information from the fat table from the subscribers." As I was 
speaking, the salesman was trying to interrupt me, finally succeeding at this 
point. 


"Well, I can see you have a lot of questions," the salesman evades rather well. 
"So I’m sure this gentleman over here will be glad to answer any of your 
questions, while I can take this lady’s question...Yes?" 


I was approached by another salesman who asked me what questions I needed 
answered. I said none, seeing as I didn’t have much interest in his system 
anyhow, and that I was just seeing how good the Prodigy salespeople worked 
under pressure. He said he would be glad to answer any questions I had, but if 


2.txt Wed Apr 26 09:43:39 2017 15 


I were only there to harass people, to please take it elsewher 


Then it was off to the various other setups. Magazines were on display and 
free for the taking here, including Mobile Office, Various Nintendo/Game System 
magazines, and Audio Equipment. Walking down one of the back isles, I heard a 
bit of conversation that caught my ears. 


Star Trek Straight To Your Home 

"Computer. Recognize Picard, Jean-Luc. Kitchen Lights ON, Turn ON the VCR and 
hit RECORD. Close the Curtains, and turn on the Extasy Channel. Prepare to 
record "Chicks with Dicks." 


— Jean Luc Picard 
Stardate 1992.4, 2:45 A.M. 


Such a Scenario is something you would think you could find only on Star Trek, 
right? Wrong. With the Mastervoice, the "Ultimate in Home Automation", the 
mastervoice is much like your own personal butler, telling the correct time, 
activating and operating any device in your household, and even with it’s own 
alarm system. All of this, at the command of your voice. 


Mastervoice can be designed to be used by up to four people, can be trained in 
any language. It distinguishes who is speaking, obeys the commands, but also 
speaks back to you -- in a HUMAN sounding voice. Male or Female. You can add 
or delete voices from it’s recognition systems, you can also create new 
response words as well. 


Featuring control over lights, stereo, TV, coffee maker, heating and cooling 
systems. It also has a Household Noise Override that allows you to have stupid 
children racing around your home in an obnoxious manner without disturbing the 
unit. 


Plus, it is also a speakerphone/telephone with stored numbers. At the sound of 
your voice, it will dial or answer incoming calls and allow you to carry on a 
conversation without ever having to touch the system. It also interfaces with 
your PC for memory storage or control operations. 


Built in infrared sensor and intrusion detection systems are another highlight 
of this demonstration. As it recognizes up to four voices, you can assign a 
password for each voice, being anything from "I am home" to 
"Supercalafragilisticexpialidoshes". If all fails, it can call the police for 
you. Nutty as all hell. 


Mastervoice operates thru carrier current modules. This model, as one of the 
top of the line voice-recognition home-use systems, it is up there in the 
$4,000 plus range, but seeing all the stuff it does, it’s well worth the price. 


Skipping the Game Module Section (Nintendo/Sega/TurboGraphix/etc) entirely, I 
ran into an interesting palmtop known as the Psion Series 3, and their new 
interlink software. Windows Compatable, the palmtop not only has communication 
software for a link between your PC and Palmtop, but also will support standard 
Hayes and Hayes compatible modems. Sporting a qwerty style keyboard anda 
romcard port, 128k and a 40 column screen, the Series 3 may be limited, but 
provides an acceptable amount of access to other online services. Though for 
now, a Windows based software package is only available, at the time of this 
writing, there will be DOS and UNIX compatible packages available to the public 
in 5 to 6 months. 
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Welcome 
you, the user 
month, I brin 
founder of th 


==Phrack Inc.== 
Volume Four, Issue Forty, File 3 of 14 
==Phrack Pro-Phile== 
Written and Created by Taran King (1986) 
to Phrack Pro-Phile. Phrack Pro-Phile is created to bring info to 
s, about old or highly important/controversial people. This 
g you perhaps the most famous all underground hackers and the 


e Legion of Doom. 


Lex Luthor 


Personal 


Past handles: 


Handle origin: 


Date of Birth: 
Height: 
Weight: 

Eye color: 
Hair color: 

Computer: 

Email address: 


The Intervie 


by Taran Kin 
TK = Taran Ki 
LL = Lex Luth 


TR: So Lex, 
been aft 


LL: Well, I 
computer 
publishi 
concentr 
importan 
paramoun 
won’t be 
say I’d 


TK: How did 


LL: It was e 
sorry. 
used to 
adventur 
savings 
Being pe 
friend t 
suit. He 
using th 


Lex Luthor 

I really no longer identify with "Lex Luthor" and don’t ever 
expect me to use the handle again with regards to calling 
boards so you CAN call me "Johnson." 
I was too status conscious to have more than one handle. All 
my effort went into just one persona. 
From the Superfriends/Justice League of America (ABC TV) 
cartoon series where the Legion of Doom (LOD) kicked their 
asses until the series writers thought up some lame way for 
them to win, but of course, LOD always escaped to fight another 
day. 

You should know better than that. 

You should know better that that. 

Approximately 610 Newtons plus or minus a few. 

With or without colored contact lenses? 

With or without my wig disguise? 

Apple //+ collecting dust and a soon to be obsolete IBM 286. 
lex@stormking.com 


w Of Lex Luthor! 


g 


ne 
or 


why have you finally relented to a Pro-Phile/interview when I have 
er you to do one for about 5 years now? 


have to admit that I am still reluctant. [This whole issue of 


security/insecurity, hacking/phreaking, philes/electronic 
ng, etc. is still quite controversial and I would prefer to 
ate on strictly legitimate activities. Especially areas where th 
ce of opinions are negligible and the importance of facts are 
t, as in Science and Engineering. However, I realize that Phrack 
around forever, so I thought that if I had any last words left to 


better say it now so here I am. 


you get started into hacking/phreaking? 


asy. I had a delicious shake for breakfast, one for lunch and oh 
No really, it WAS easy. I had a friend who bought an Apple and I 
go over to his house and watch him play Ultima I, a fantasy/ 

e game. After drooling over Ultima long enough, I took all my 
and bought a system, which was in excess of $1000 at the time. 
nniless, I had nothing else to do but learn the machine. My 

hen purchased a modem and started calling boards. I followed 

was interested in cracking software and became rather well known 
e handle "The Punk". After he gave me some codes for various LD 
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companies I started calling around. A short while later, I noticed that 
there were boards, sections of boards, and most importantly INFORMATION 
that I was not permitted to use/see. I was unhappy about being excluded 
especially from RACS III (Tuc eventually came around though) and took it 
upon myself to learn what was involved in accessing these systems and 
getting more information. I realized as most have, that providing 
information that others do not possess allowed me to be noticed and 
therefore gain more information. By the way, I still play Ultima, I 
BOUGHT Ultima VI two years ago but am just getting around to playing it 
now. 


TK: What was more important to you, getting noticed or getting information? 
LL: The information was undoubtedly the goal. I realize now, as many hackers 
and phreaks have in retrospect, that I am an INFORMATION JUNKIE. The 
notoriety was simply the means to be trusted with more information and 
knowledge. Unfortunately back then I was unaware that most of the 
i 
i 
i 


nformation that I seeked was available LEGALLY. I was blinded by the 
nformation itself, and did not concentrate on the *methods of obtaining 
nformation*. Now with the advent of CD rom databases, and also online 
databases, the information is readily found. The problem is that the 
service providers are pricing the disks and online time out of the reach 
of common people, which of course puts me back to square one in a way. 


TK: Why do you need information? 


LL: Look, if there is one thing that prevents people from doing things or 
pursuing their dreams, its INFORMATION. Not money, not guts, not 
anything. With the right information just about everything else can be 
obtained with the exception of health and happiness I suppose. 


TK: Give me an exampl 


LL: Okay. If you have ever been up late watching TV and ’ol Dave Del Dotto or 
Carlton Sheets or whomever gets on and is trying to sell you their 
"courses" on Real Estate, Buying at Government Auctions, etc. then you 
know what I am talking about. These guys made millions simply by 
obtaining information that the majority of people were not aware of and 
put it to use, they could have been anybody. 


TK: What types of information do you look for? 


LL: Although I always look to learn new ways of how to obtain information in 
general, i.e., what new databases are available and how to use them, etc. 
I am currently concentrating on scientific data since I am working on my 
Master’s Thesis and a comprehensive literature search is required to 
prevent me from duplicating what has already been accomplished. The 
"don’t re-invent the wheel" philosophy. 


TK: You mention a thesis, what schooling have you had/are pursuing? 


LL: I don’t want to be too specific, however, I have an undergraduate 
engineering degree and am currently in the process of completing dual 
Master’s degrees, one in Quantum Physics and the other in Engineering. 


TK: Sounds heavy, but why be vague, you must have a computer-type or 
electrical engineering degree? 


LL: No, and I get that a lot from old friends: "You are so good with 
computers, why aren’t you doing that?" My interest in computers now is 
simply to make them calculate equations and do simulations of physical 
systems. And to help me get more information. 


TK: Let’s get back to the H/P subject, there’s a few people who have always 
contended that you and the guys in LOD really didn’t know much of 
anything, is that true? 


LL: Well I can’t speak much about the old members, but their expertis 
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satisfied me and other members (we would usually vote on new members, I 
wasn’t a dictator you know). As for me, I realized early on that only 
certain people can be trusted with certain information, and certain types 
of information can be trusted to no one. Giving out useful things to 
irresponsible people would inevitably lead to whatever thing it was being 
abused and no longer useful. I was very possessive of my information and 
frequently withheld things from my articles. By not providing much data, 


some people may conclude that I didn’t know anything at all. Its just 
that I didn’t release it to just anyone and that dismayed various people 
probably to the point of lashing out at me and LOD. 


Taran King: 


Knight Lightning: 


The Blue Archer: 


LUG 


Paul Muad’Dib: 


Bioc Agent 003: 


Cheshire Catalyst: 


Control-C: 


Phantom Phreaker: 


The Videosmith: 


Dr. Who: 


Telenet Bob: 


Jester Sluggo: 


Compu-Phreak: 


Silver Spy: 


Erik Bloodaxe: 


Mark Tabas: 


You were always hounding me for a Phrack Pro-Phile. Hope 
you are enjoying it. 


Great guy, but how did he get so famous even though he never 
even broke into the E911 computer? Sad to see him get 
screwed by overzealous "professionals." Wish I had some 
money to donate to his defense fund. 


Always wanted to meet him. I never got a chance to meet him 
face to face although I have known him for 8 years. To be 
honest, he was better at getting into systems than I was. 


Always willing to bend over backwards to help you out. I 
still use the briefcase he bought me in NYC many years ago. 


The one in New York. He is one of the smartest people I’v 
ever met. I hope he is doing something worthwhile. 


Talked to him quite a number of times and met him at TAP 
meetings, but we never got to be friends. 


I still owe him $20. He lent it to me in NYC. 


A wildman with the women. I hope he gives me his STARGATE 
videogame when he gets tired of it. I don’t play it every 
day like him, but I still can kick his ass. 


He has a spiritual side to him that most people never 
realize. 


A fun person with talent. I was sad to see him leave the 
scene so early. Met with him in his home state two years 
ago just to say hello. 


Here is a guy who loved hacking and exploring systems. I 
mean he really enjoyed it. He got quite good at it too. 


Met him up in Massachusetts at Dr. Who’s conference. 


Met him up in Massachusetts along with The Sprinter. 
Obviously he knew more than he let on even way back then. 


I liked listening to his pirate radio station while he 
operated it. The FCC never did catch on. 


A very smart guy with a future. Someone who knows when to 
stop, but was a little bit panicky at times. 


Part of the original LOD group. I think he always wanted my 
job. I consider him a friend even though we had our 
misunderstandings. 


Part of the original LOD group and sysop of Farmers of Doom 
(FOD) for the short time it was up. I hope he isn’t in any 
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Flash Hoser: 


Gary Seven: 


Digital Logic: 


The 


Ronz!: 


Al Capone: 


Quasi Moto: 


trouble again. 


A fellow information junkie in the Great White North (GWN). 


Probably one of the least known yet talented hackers around 
except that I mentioned him in the acknowledgement section 
of many of my files. He has since quit. 


Ran a good board for quite a while. An idealist who could 
give a great speech. Too bad no one would listen. 


Old friend who no one ever heard of unless they called 
Digital Logic’s Data Service BBS. 


Should have been born a few years earlier so he could have 
gotten into hacking when it was fun. He got into it too 
late and the risk became a little too high for him. 


Sysop of Plovernet. Was a good sysop, but not much of a 
hacker. Still talk to him on the net. 


King Blotto: Known him a long time. Glad he never put me on 
eleTrial! 

The Mentor: A fantastic writer. He ran a great board (Phoenix Project). 
The last time I talked to him was a few years ago, but he 
wasn’t very talkative. I think he fell for the ’ol Lex is a 
rat rumors. 

The Leftist: I hitched a ride with him to one of the SummerCons in 
St. Louis. Haven’t talked to him since his trouble began, I 
hope he’s cleaned up his act. I thought he was cool until I 
heard he was making stuff up about me to the investigators. 

The Prophet: A kindlier gentler hacker. Sorry to see him get screwed by 
the system. 

The Urvile: Met him at SummerCon ’89. Definitely seemed to be the type 
who you could trust not to screw you over. 

Sir Francis Drake: Met him at SummerCon ’87. I’m glad I got a chance to. 

Sir Knight: What a character. 

Shooting Shark: I appreciate the favorable comments he made about me in HIS 


Phrack Pro-Phile. 


A Few Other Things 


ile I’m on the subject of people, there is one thing that I have not see 


published in any form, and that’s a "Where are they now" type of thing for 
ex-hacks/phreaks. Just so people know, there are a number of us who are doing 
quite well at lawful pursuits. 

For example: 

Silver Spy -— Completing a Master’s Degree in Electrical Engineering. 
Knight Lightning — Working to become a lawyer. 

The Unknown Soldier - A high level manager at a successful software company. 
The Mentor -— Creating games at a well known game company. 


Gary Seven 


Jester Sluggo 
The Disk Jockey - Working in the computer business. 


- Working for a 'high technology’ company. 


Chief engineer at a radio station. 


The Interview With Lex Continues 


In an early issue of Phrack you were referred to by the following: 
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"There is paranoia and beyond paranoia there is Lex." How do you respond 
to that? 


Ha Ha, I remember that one. Well of course there is some truth to it. 

And the saying, "better paranoid than sorry." is true as you can see since 
I am not behind bars... not that I ever did anything illegal of course, 
ahem. I should mention that I met two individuals early in my hacking 
career that had a significant influence on me, and both are the absolute 
epitome of paranoid. 


One was "Eliott Ness" who was probably in his late 30’s to 40’s by the 

sound of his voice. He used to call LOD, I met him on a local board. He 
was extremely knowledgeable, but always knew when to stop giving general 
i 
fe 


nformation, never gave out ANY personal information, and never 
ommunicated for any length of time. 


The other guy was "Number 6" from TAP meetings in NYC. I met hima few 
times. Six was another older gentleman. He was very calm until anyone 
showed up with a camera. Then he "went off" until the camera threat was 


negated. This guy had a way of extracting information out of you without 
you even realizing what he was up to. 


As I recall people would ask him a question and he would simply turn it 
around and say, "well, what do you think (or know) about so and so" and 
the hapless phreak would spill his guts with Six taking notes and 
sometimes making corrections to what the phreak said much to the phreak’s 
surprise. But Six never really gave out much information although it was 
completely apparent to me that he knew a great deal just by the way he 
carried himself. 


A few phreaks would try to follow him after the TAP meetings, but he 
always lost them without ever letting on that he knew he was being 
followed. It should be mentioned that paranoia can destroy you (as the 
song goes). A number of times I ran into real problems trying to escape 
from suspected problems that probably weren’t anything to worry about. 


What memorable H/P BBSes do you recall? 
OSUNY: Caught the tail end when I first started. I was impressed. 


Plovernet: That BBS was crazy. Constantly busy since it had hundreds of 
active users and Quasi Moto let everyone post whatever they 
wanted and never deleted messages unless there was no disk 
space left. We helped start the "philes" trend there also. 

It was easy to spot who knew what they were talking about so I 
invited them onto the LOD BBS. Some of the people on the LOD 
BBS were then asked to join the now infamous LOD group. 


(*Interrupts*) Did you ever think the group you started would become a 
household name in security and hack/phreak circles? 


Although I knew the guys in the group were good hacks/phreaks, I had no 
clue of where it was leading. Since we did not tolerate destructive/ 
malicious behavior nor things like credit card fraud I did not think there 
was much risk in the group as a whole getting any real attention. Of 
course, all that changed with time. 


Sorry for the interruption. Please continue. 


Metal Shop Private: The users were idealistic and good natured which was 
refreshing. I liked it most because it was a good 
source of information/files and we were the first to 
see new Phrack issues. 


Farmers Of Doom: Mark Tabas did a fantastic job with this one. It was 
quite busy, but did not remain up very long. 


Phoenix Project: Again, another fantastic job. The Mentor had some 
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rather unconventional ideas like letting security people 
on, which I thought was a good idea. 


RACS III: Tuc didn’t give me the time of day at first, but eventually I 
got on. Then he took it down. 


Pirates Cove: The board in 516 (Long Island, NY). One of the classics. 
It’s where I met Emmanuel Goldstein and invited him onto 
Plovernet to help sell 2600 subscriptions. 


Catch-22: Absolutely positively the most secure BBS I ever encountered. 
Besides passwording subboards along with requiring users to 
have a high enough security level to access them, it made use 
of many concepts from the "basic security model" introduced by 
Lampson and later augmented by Graham and Dorothy Denning. Of 
course Silver Spy and I had no clue what an access matrix was 
and things of that nature. A duress password was implemented 
so if someone got nailed they could enter the password, not 
compromise the system, yet appear as to be cooperating with the 
authorities who we presumably thought would ask the hacker to 
call. It was never used but nice to have. 


BlottoLand: Good board for a while, but he let too many of his "loyal 
subjects" on the system who were locals and they eventually 
overran it. 


Do you REALLY think you are ELITE or what? 


I really don’t know how anyone got the idea that I considered myself 
elite. The only people who said I thought I was elite were those who I 
never met or talked to. Contrary to some people’s belief, I never 
considered myself as elite. I was just a guy who liked to pass 
information on to others so I wrote some files. The files did help me get 
access to more information by making me more well known. When I read th 
newspaper, I’m one of those annoying people who keeps interrupting your 
breakfast to tell you details about all the neat stories. 


Speaking about the group, what do you think about Erik Bloodaxe and others 
starting ComSec Data Security? 


When I first called Bloodaxe after I saw them in the papers/magazines he 
thought I would be mad, maybe that he took my idea or something. I told 
him I am familiar with the computer security consulting business and don’t 
want any part of it. It’s too tough to get people to pay money for 
something that they cannot get a verifiable return on their investment. 
Besides, getting them to trust you with their inner most secrets is 
extremely difficult. 


I told ComSec to write articles about security until their fingers fell 
off. Legitimize themselves as soon as they can. There was too much 
prejudice out there against them with ComputerWorld leading the pack. I 
really think they could have helped some companies if given a chance. But 


I don’t think they had enough knowledge about the whole security picture, 
i.e., Physical Security, Environmental Systems (fire suppression, UPS, 
etc), Administrative Security (Hiring/firing policies, etc.), what goes on 
in big IBM shops MVS, CICS, ROSCOE, etc. There is a lot involved. 


How did you feel when Knight Lightning and Phrack erroneously insinuated 
that you might have informed on other hackers, maybe even the Atlanta 
Legion of Doom members a few years ago? 


Well as you now know, Craig (KL) has seen all the documents and records 
from his trial and many documents from the Atlanta case and there was no 
mention whatsoever of me in regards to providing information, being a 
witness, testifying, etc. 


Although I haven’t talked to the Atlanta guys since before their trial I 
am sure they know I had absolutely nothing to do with what happened to 
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them. The real story has since come out. If there is one thing I hate, 
it’s being accused of something you didn’t do. 


If someone does something they are accused of, he should be man enough to 
admit it. I have said this before a number of times, I have never 
provided information to anyone about other hacks/phreaks that directly nor 
indirectly led to them being visited, arrested, or prosecuted. It’s just 
not my way. What goes around comes around and that kind of boomerang is 
something I knew I didn’t want to play with. 


My success in avoiding trouble is fairly straightforward: Most of all it 
was secrecy and misdirection (ala Stainless Steel Rat), avoiding phone 
company computers especially those in which I was a customer of (i.e., my 
local RBOC) because if you get THEM pissed at you, they’ll get you one way 
or another. Also, lots of LUCK and not intentionally making any enemies 
although there have been a few hackers mad at me whom I never even talked 
to and I have no idea as to why they didn’t care for me. 


Do you have any advice for people out there who may want to begin hacking 
or phreaking? 


I am not one to dictate what people should or should not do, but I 
wouldn’t if I were them. The technology to prevent and detect security 
breaches and then to track down their source is ever improving. The 
Cuckoo’s Egg (by Cliff Stoll) provides a good example of that. But that 
shouldn’t even come into the picture. 


I think they should examine objectively why they want to do it. [Then make 
an honest attempt at finding other legal ways to accomplish whatever they 
were trying to do. I don’t care how you justify it, its dishonest. 
Forget about the law part of it. It just causes other people problems. I 
didn’t know how much until my school’s systems were hacked and I was 
unable to read my e-mail for a week. I was angry and thought to myself 
that I’d like to get my hands on that asshole hacker. Then I laughed for 
quite awhile realizing what I was thinking and the irony of it all. 

Poetic justice I suppose. None of my data was touched, but I was denied 
service and denial of service can be just as damaging. As for the 
challenge of it, well I can’t deny that that was very addicting, but there 
are many legal ways to challenge yourself. 


What conventions/involvements outside of phone calls have you done? 


TAP meetings were probably the first. Then a Con in Massachusetts, the 
Con in Philly with Videosmith et al. and of course the few SummerCons 
(1987 and 1989) in St. Louis. There were some computer security 
conferences that were interesting also. Those helped to sensitize me to 
the "other side." 


I remember at SummerCon ’89 that you were accidentally caught on video 
tape for about 2 seconds and requested that it be erased, which it was. 
What is the deal with cameras? 


It may sound a little odd, but I don’t think anyone has the right to take 
another person’s picture without their permission. Especially when the 
person who is on film has no idea where the picture will end up. 


I predict within 5-10 years maximum that states will start using video 
cameras to digitize your picture when you go for a new driver’s license. 
The digitized image will be stored with the rest of your personal 
information and probably be available to peopl like private investigators 
and others who gain access to the information illegally. With ISDN, 
Multi-Media, etc., it will be possible to "set up" people very easily by 
altering images via computers, etc. to make them look like they are doing 
just about anything you can think of. When things like that start to 
happen I will not look crazy but smart, at least to my friends who think 
my avoidance of cameras is abnormal. 
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Memorable Experience 
What are your most memorable experiences (funny things that happened to 
you during your phreaking/hacking or not so funny) ? 


Dr. Who in Massachusetts had a conference in which me, Tuc, and The 
Videosmith drove up at 4 AM in Tuc’s VW Beetle hydroplaning all the way 
due to the rain, and dead tired. We were all in a silly mood and had a 
lot of laughs. 


Also, the time when I was in NYC with Paul Muad’Dib and we had no money to 


eat. He was the first person I know of who had any real knowledge of 
phone company switching systems. He engineered a switch in Manhattan to 
put call forwarding on a pay phone. Once this was done, all the money put 


into the phone would remain in the phone but would not drop into the coin 
box. Those who put money in didn’t really have to since the phone was 
converted to a POTS (Plain Old Telephone Service). Alas, humans are 
creatures of habit. So after a couple of hours (since it was a busy 
phone) he had the guy put the phone back to the way it was. When this was 
done, all the money held in the phone was returned. It was like hitting 
the jackpot in Las Vegas. We then proceeded to McDonald's. 


The story about me running around naked in a Motel 6 parking lot that 
Control-C has tried to get people to believe is, of course, grossly 
exaggerated. His girlfriend hooked me up with a friend of her’s. Dan and 
his girl were in another room. He called me to come over, but I was in my 
underwear. We had been drinking so I ran the 8 feet or so to his room (we 
were on the 2nd floor with a solid balcony so no one from the ground could 
see anyway), I said hello and then ran back to my room to go another 
round. 


Probably my favorite memory is relatively recent. J.J. Bloombecker, 
Director of the National Center for Computer Crime Data, spoke at my 
school. I sat in the very back as usual (I hate to have anyone sitting 
behind me, anywhere) in a room of about 40 people and listened to his 
speech which basically was to promote his book, "Spectacular Computer 
Crimes." I spoke to him but never let on who I really was. He talked 
about Craig’s (Knight Lightning) case and then he went on about whomever 
named LOD, the Legion of Doom, should have named them something like the 
"Legion of Ineffectual Pansies." The reason being that, what prosecutor 
in his/her right mind would go to a judge and say how dangerous a group of 
ineffectual pansies are. 


I sat there trying not to blush and thinking that of all the hundreds of 
people he said that to, he probably never expected to say it to the person 
who really named the group. 


I did meet Donn B. Parker, whom I consider the father of computer 
security, twice. The first time I just shook his hand. The second time 
was relatively recently and we spoke for 20 minutes or so. I never told 
him who I really was, not that he would know anyway. But I complimented 
him enough so even if he found out, he couldn’t have gotten too mad at me. 


What were some of your memorable accomplishments (newsletters/files/etc.)? 


The REAL accomplishments (non-files) will remain anonymous, but my 
favorite files were the IBM VM/CMS series because they were well written 
along with the Attacking, Defeating, and Bypassing Physical Security 
Devices series. Before I wrote a file I scoured boards and other 
traditional sources for the information I sought. If I came up empty 
handed, I researched it and wrote about it myself. 


Although the COSMOS files helped me get started, they were a complete 
joke. They provided enough information to be dangerous and didn’t help my 
standing with the RBOC’s. The VAX/VMS files got better as they 
progressed, but except for some of Part III they didn’t provide much that 
wasn’t available in manuals. I enjoy writing, but it usually takes me 
many revisions to get it just right. As for newsletters, the LOD/H 
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Technical Journal is another thing that I was involved in. 


What is the story behind the LOD/H Technical Journal? 
The LOD/H Technical Journal almost never was. As you are aware, LOD had 
gotten a group of files together to be published in PHRACK as an "all LOD 
issue," but some of the members thought we should put out our own stuff. 
The idea grew on me and I said okay. I should let it be known that you 
helped us out for the first issue by spell checking it and performing some 
editing and critique. But we were only able to produce 4 issues since it 
was difficult in getting quality non-plagiarized or non-highly paraphrased 
material. 


After the third issue, I realized that I was probably not doing anyone any 
favors by exposing security holes and weaknesses in systems. Some people 
may not believe hearing this from ME, but I don’t agree with those hackers 
who think they are doing people a service by exposing their system 
vulnerabilities. Nobody needs someone checking their door at night to see 
if its locked. And although the old door analogy isn’t exactly the same 
as the pseudo-physical computer login, its close enough. Sorry about 
getting off the subject a little. 


That’s okay. Why did you quit the H/P community? 


I wrote a letter to 2600 Magazine about a year ago that goes into it a 
little. Between that and what I’ve said here, it should be fairly 
apparent. In brief, I realized I was mainly in it for the purpose of 
getting information. It got too dangerous and I decided to direct my 
energy to graduating instead of how to defeat security systems. The 
thought processes involved in hacking and those in solving problems in 
Engineering Design are remarkably similar and I think my hacking experience 
makes me a much better designer and problem solver. Not that I am 
advertising for a job or anything... 


Lex’s Favorite Things 


Women: Without Diseases. 


Cars: So fast that you are terrified to put the pedal all the way down to 
the floor. 


Foods: Anything that does not contain pesticides, herbicides, heavy metals, 


radioactive elements, toxic chemicals, harmful microorganisms, 
artificial colors, or preservatives. I guess that rules out fish, 
produce, meat, processed foods, drinking water, and so on. In other 
words there’s nothing left to eat. In all seriousness, I do like 
great big salads and if I was rich I would have an awesome wine 
cellar. 


Music: Heavy Metal, some Punk, and Classical. 


Authors: Richard P, Feynman, Isaac Asimov, Stephen Hawking, Jane Roberts, Budd 


Hopkins, Jacques Valee, Bruce Sterling, K. Eric Drexler, and Matthew 
Lesko. 


Books: I liked the Cuckoo’s Egg, anything about physics, and non-kook 


metaphysical books. The only thing I collect these days are books. 
I have hundreds of them. 


Games: Atari’s ASTERIODS DELUXE was probably the most difficult videogame 


ever (even though it’s more than ten years old) and which I am one of 
the best there is at playing it. When it comes to this, I admit I AM 
Elite. There’s almost no one on this planet who can beat me. 
Defender and Stargate are also great. They don’t make games like 
they used to. And of course, the Ultima series. 


Actors: Dana Carvey, Bill Moyers, Patrick Stewart (ST:TNG), Jonathan Frakes 


(ST:TNG), Andy Griffith (Matlock), and too many movie stars to 
mention. 


The Interview Concludes 


Is there anyone specifically that you want to say a few things to? 
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To all those who subscribe to the "Once a thief, always a thief" mentality 
and to those few die-hard law people who would love to get their hands on 
me and other ex-hackers: Don’t bother, people are basically good and can 
be "rehabilitated" without going to prison. 


The other thing that I have never understood about the hack/phreak 
community is some of the obsession with tracking people down. I could 
understand it a little better when the reason was to check out others to 
make sure they were not feds. 


I never compiled lists of who I talked to with anything except their 
handle, first name, and phone number. I never CNA’d them for their last 
names, or tried to find out where they worked. 


But some guys just had to know everything about everyone. Don’t they have 
anything better to do? I was careful yes, but not to the point of 
invading everyone’s privacy especially when the person stated they just 
wanted to be left alone. I am not saying I NEVER invaded another’s 
privacy, but I don’t now and almost never did it in the past. 


I left an Internet mailing address at the beginning of this Pro-Phile so 
people can contact me. I don’t mind talking to people, but I just don’t 
think it’s fair to harass and threaten people who don’t want to be 

bothered. I am open to useful and constructive conversations via email, 
but I really don’t think it’s necessary to compile individual’s personal 
information. I never did it and will never understand why people do it. 


Besides, it’s no great accomplishment to find people these days. The ways 
of getting information are numerous and many are legal, so how much skill 
does it really take to get someone’s info? Almost none. Anyone can do 
it... on just about anyone they want. 


What do you think about the future of the hack/phreak world or telecom 
communications in general? 


As for the hack/phreak aspect, every time I think hacking is dead and 
people would have to be deranged to break into computers or make phone 
calls illegally for free, I read about another hapless person or group of 
people who have done it. Don’t they realize there are better and easier 
ways of going about whatever they are doing? Don’t they realize that the 
technology to CATCH you is such that you have lost the fight before you 
even get started? 


Yes there will be new technologies that will help both sides, but there is 
the law of diminishing returns. As for what hackers should be doing, if 
anything they should keep an eye on our right to privacy. If it weren’t 
for hackers, TRW would still be screwing people over (worse than they do 
now) and would have never apologized for not correcting invalid credit 
information. 


And of course the question that no Phrack Pro-Phile does without... 


Of the general population of phreaks you have met, would you consider most 
phreaks, if any, to be computer geeks? 


Absolutely NOT. I don’t judge people on how they look anymore (yes I used 
to). As The Mentor so eloquently put it in his Hacker Manifesto (Phrack 7 
and again in Phrack 14), of which this is, but a lame paraphrase, it’s 
more important to relate to people on what they know and on their ideas 
than what they look like or what color their skin is, etc. And the vast 
majority have non-geeky ideas. 


Thanks for your time, Lex. 


Thank you for letting me ramble on for so long. 
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< How to Acquire Information on Internet Computers > 
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


Compiled from Internet Sources 


by The Racketeer 
of The Hellfire Club 


Network Miscellany created by Taran King 


Generally speaking, information is everything. A lot of hacking any computer 
on a network is being able to gather information about the machine and its 
vulnerabilities. This file is about using the available resources on the 
Internet network in order to gain important information about any perspective 
sites. 


A large amount of information has been printed in Phrack recently about the 
Internet, most of it copied straight from manuals and in my opinion lacking 
hacking flair. Therefore, I’m going to take you straight into the heart of the 
heart of the matter with this file on acquiring information! 


Now, the Internet is notorious for not having an instruction manual. Most 
people who find out what the Internet is learn from their friends. It used to 
be that there was only one real landmark on the Internet, and that was the 
SIMTEL-20 FTP archive. Now, the Internet is probably the largest fr network 
in existence. In fact, it’s a hacker’s paradise! 


Unfortunately, you have to know about "public" sites on the network before you 
can use them. Likewise, how are you going to hack an organization if you don’t 
know any machines on it? Sort of like trying to complain to Packard-Bell about 
your computer equipment not working when the bastards don’t supply their name, 
address, or phone number. You are going to have to find another way to get that 
information if you want to get anything done. 


There is not any one particular way to learn about a site. In fact, you’1ll 
have to combine several unusual methods of gathering information in order to 
obtain anything resembling a "complete picture." However, using the 


combinations of techniques described in this file, you can maneuver through any 
network on the Internet and learn about the machines within. 


The first stop on this journey is the ARPANet Network Information Center 
(frequently called "NIC" by experienced network users). NIC’s purpose is 
simply to keep track of all the network connections, fields, domains, and hosts 
that people wish to be told about. 


To connect to NIC, you would issue a command from your Internet connected 
machine similar to this: 


F command 
\/ 


[lycaeum] [1]> telnet nic.ddn.mil 


This will (within a short period of time) route you to the Network Information 


Center and grant you access. There isn’t a straight forward login/logout 
system on NIC like other Unix computers; it will just connect you to the 
Information System upon connection. The message you will get will be similar 
to this: 

* —- DDN Network Information Center -- 

* 

* For TAC news, type: TACNEWS <return> 

* 


For user and host information, type: WHOIS <return> 


nwy 


.txt 


+ + F 


SRI-NIC, 
@ <prompt> 


Great, 
book, 


now 
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For NIC information, 


we are 


in. 


t 


ype: 


For user assistance call ( 
Report system problems to ACTION@NIC.DDN.MIL or call 


Essentially, 


800) 


TOPS-20 Monitor 7(21245)-4 


corporation known as UNISYS. 


@WHOIS 


SRI-NIC WHOIS 3.5(1090)-1 on Tue, 
Enter a handle, 
by a keyword, 


details, 
---> Do “*E 
Whois: 


Okay, 
and ask it 


Whois: 


Cartee, 


Melissa 
Ebersberger, 
Lichtscheidl, 
Naval Warfar 


na 
like 
"HELP" 


about 


unisys 


(MC1 
Eugen ( 


Mark J. 


me, 


mailbox, 


235- 


2 


NIC <return> 


3155 or 


we need to let our fingers to the walking. 
simple commands as I go after one of the government contract giants, 


(415) 


859-3695 
(415) 


859-5921 


since NIC is just a great big telephone 


Let’s demonstrate a few 


Let’s start by entering WHOIS. 


or ot 


"host sri-nic". 


42) 
EE35) 
(MJ 


now we are in the database. 
"Unisys." 


L28) 


for full documentation, 
to show search progress, 


22 Aug 91 15:49:35 PDT, 


her field, 
Type won 


Since Unisys is our target, 


unisys@email.ncsc.navy.mil 
@HICKAM-EMH.AF.MIL 


UNISYS 
UNISYS 


Assessment Center 


(UNISYS) 


@BUCKNER- 


EMH1.ARMY.MIL 
UNISYS .NWAC.S! 


the 


load 9.64 

optionally preceded 
for short, 
or hit R 


2-page 
ETURN to exit. 
“G to abort a search or output <--- 


let’s go ahead 


(904) 234-0451 
(808) 836-2810 
(DSN) 634-4390 


EAO6.NAVY.MIL 


L376 J0'sa 2 


Navratil, Rich (RN74) UNISYS@COMISO-PIV.AF.MIL (ETS) 628-2250 
There are 28 more matches. Show them? y --> of course 
Peterson, Randy A. (RP168) UNISYS@AVIANO-SBLC.AF.MIL (ETS) 632-7721 
Przybylski, Joseph F. (JP280) UNISYS@AVIANO-SBLC.AF.MIL (ETS) 632-7721 
UNISYS Corporation (BIGBURD) BIGBURD.PRC.UNISYS.COM 128.126.10.34 
UNISYS Corporation (GVLV2) GVL.UNISYS.COM 128.126.220.102 
UNISYS Corporation (MONTGOMERY-PIV-1) MONTGOMERY-PIV-1.AF.MIL 26.5.0.204 
Unisys Corporation (NET-MRC-NET) MRC-NET 192.31.44.0 
Unisys Corporation (NET-SDC-PRC-CR) UNISYS-ISF-11 192.26.24.0 
Unisys Corporation (NET-SDC-PRC-LBS) UNISYS-ISF-9 192.26.22.0 
UNISYS Corporation (NET-SDC-PRC-NET) UNISYS-ISF-7 192) 1 2 195: 5.0 
Unisys Corporation (NET-SDC-PRC-SA) UNISYS-ISF-10 192.26.23:.0 
Unisys Corporation (NET-SDC-PRC-SW) UNISYS-ISF-8 1922.26.21 20 
Unisys Corporation (NET-UNISYS-CULV) UNISYS-—CULV 192.67.92.0 
Unisys Corporation (NET-UNISYS-PRC) UNISYS-—PRC 128.126.0.0 
Unisys Corporation (NET-UNISYS-RES1) UNISYS-RES1 1:9:2;..3:9)5Laee0 
Unisys Corporation (NET-UNISYS-RES2) UNISYS-RES2 192239. 122.0 
Unisys Corporation (NET-UNISYS2) UNISYS-B2 129.221.0.0 
Unisys Corporation (STARS) STARS .RESTON.UNISYS.COM 128.126.160.3 
Unisys Corporation (UNISYS-—DOM) UNISYS .COM 
Unisys Linc Development Centre (NET-LINC) LINC 143.96.0.0 
UNISYS (ATC-SP) ATC.SP.UNISYS.COM 129.218.100.161 
Unisys (FORMAL) FORMAL.CULV.UNISYS.COM 192.67.92.30 
UNISYS (KAUAI-MCL) KAUAI .MCL.UNISYS.COM 128.126.180.2 
UNISYS (MCLEAN-UNISYS) MCLEAN-UNISYS.ARMY.MIL 26.13.0.17 
UNISYS (NET-UNISYS-RES3) UNISYS-RES3 192.67.128.0 
Unisys (NET-UNISYS-SP) UNISYS-SP 129.218.0.0 
UNISYS (SALTLCY-UNISYS) SALTLCY-UNISYS.ARMY.MIL 26.12.0.120 
UNISYS (SYS-3) SYS3.SLC.UNISYS.COM 129.221.15.85 
Wood, Roy (RW356) UNISYS@LAKENHEATH-SBLC.AF.MIL 
0044-0638-522609 (DSN) 226-2609 
As you can see, the details on these computers get fairly elaborate. The first 


"column" 
title, 


is the matching information, 
then it is followed by a phone number or IP port address. 


second column is the network name or 


If the phone 
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number has an area code, then it is of a standard phone nature; however, if it 
is (DSN) then it’s on the "Data Security Network," aka Autovon (the military 
phone system). 


Now, as you can tell from the above list, there are several UNISYS accounts at 


military machines -—- including a military machine NAMED after Unisys (mclean- 
unisys.army.mil). This stands to reason since Unisys deals mostly in military 
computer equipment. Since it is a secretive military group, you’d figure an 


outsider shouldn’t be able to gain much information about them. 
Here is what happens if you center on a specific person: 


Whois: cartee 
Cartee, Melissa (MC142) unisys@email.ncsc.navy.mil 
7500 McElvey Road 
Panama City, FL 32408 
(904) 234-0451 
MILNET TAC user 


Record last updated on 18-Apr-91. 


Hmm... Very interesting. This user obviously has access to military computers 
since she has a TAC card, and goes under the assumed identity as "Unisys" in 
general. Could this person be a vital link to the Unisys/U.S. Defense 


connection? Quite possibly. More likely she is a maintenance contact, since 
she can use her TAC card to contact multiple (confined) military networks. 


I’ve gone ahead and requested specific information about kauai.mcl.unisys.com, 
which as far as I know is a focal point for the Unisys Networks. Of course, 
the information on this machine is non-classified (or if it IS classified, 
Unisys will probably be chewed out by Uncle Sam). Notice all the great 
information it gives: 


Whois: kauai.mcl.unisys.com 

UNISYS (KAUAI-MCL) 

Building 8201, 10th Floor Computer Room 
8201 Greensboro Drive 

McLean, VA 22102 


Hostname: KAUAI.MCL.UNISYS.COM 
Nicknames: MCL.UNISYS.COM 
Address: 128.126.180.2 

System: SUN-3/180 running SUNOS 


Coordinator: 
Meidinger, James W. (JWM3) jJim@BURDVAX.PRC.UNISYS.COM 
(215) 648-2573 

domain server 


Record last updated on 05-Aug-91. 


No registered users. 


Aha! The Coordinator on this machine doesn’t use it! There are no registered 
users! Namely, if you wanted to hack it, you aren’t screwing with the higher 
ups (this is good). Since when does Unisys buy computers from other companies? 
Can’t they just grab a few off the assembly line or something? The computer is 
stationed in McLean, Virginia! That’s where the CIA is! Could Unisys be 
developing computers for the international espionage scene? Obviously, there 
is a great deal of information to be sucked out of this machine. 


How? The answer was listed there. The machine is a DOMAIN SERVER. That means 
this computer holds the network information used to identify all the computer 
systems on its network and all we need to do right now is figure out a way to 
squeeze that information out! But first, let’s see if our hunch was correct in 
assuming the bigwigs are far away by checking out the head honcho, "Mr. 
Meidinger." 


4.txt Wed Apr 26 09:43:39 2017 4 


Whois: jim@burdvax.prc.unisys.com 

Meidinger, James W. (JWM3) jim@BURDVAX.PRC.UNISYS.COM 
Unisys Corporation 

Computer Resources 

Room g311 

P.O. Box 517 

Paoli, PA 19301-0517 

(215) 648-2573 


Record Last Updated on 04-Jul-90. 


Yup, Mr. Meidinger is far away -- Pennsylvania, to be exact. Not exactly 
keyboard’s length away, is he? Besides, being in the "Computer Resources" 
department, I’d suspect he is just an accountant. Accountants are to computing 
as beavers are to trees (unless, of course, they actually like computers, which 
isn’t a foregone conclusion in the business world). 


I’m going to skip the rest of the information on NIC, since it has been 
overkilled in this particular magazine anyway. The only hint I have is to read 
CERT’s and DDN’s news blurbs, since they give out some interesting information 
which would be useful and educational. Besides, messing around with the CIA’s 
hired goons sounds much more fun. 


Now is the time for a little bit of a lesson in critical reasoning: the 
Internet isn’t exactly a "free to the public" network, meaning you just can’t 
attach your computer to a machine on the Internet and expect it to work all of 
a sudden. You need to configure your machine around the computers in the 
network domain you are linking into, and if you have their permission, then 
everything is cool. But once you’re configured, and your router and/or server 
has been notified of your existence, does that mean anyone else has that 
information? The answer is yes, although that info won’t be forwarded to a 
place like NIC it will have to be obtained another way. 


All packets of data on the Internet need to be routed to and from valid 
computer hosts. Therefore, all of this information is stored on the network’s 
gateway. But the routing information stored is simply in numeric format, such 
as 128.126.160.3. At least, that is as understandable as it gets, since 
Ethernet addresses ar ven mor laborate and in binary. 


However, as Internet users know, there is more than a single way of describing 
a computer. "telnet 128.126.160.3" would be one way of connecting to a 
computer, or "telnet aviary.stars.reston.unisys.com" would be another way of 
connecting to the same computer. These names are chosen by the owner of the 
network, and are described through the use of "domain servers." 


As you recall, kauai.mcl.unisys.com was listed by NIC as a domain server. This 
means that the names of the computer systems on that network are stored on that 
particular host. Of course, that’s not the only thing. The domain server 
presents the computer name and IP number to the connecting machine allowing you 
to connect to the computer by using a "domain style name." Ultimately, 
everything is converted to IP numbers. 


Most network software allows compatibility with domain servers, meaning if you 
want to connect to nic.ddn.mil, and you specify a command "telnet nic.ddn.mil" 
then you will connect to nic.ddn.mil. Sadly, this isn’t true of all computers 
(which require IP numbers only), but at least it is true enough that the 
general user is likely to have such computer resources. 


Reaching back to the Dark Ages, there is a computer program that allows 
machines that don’t directly interpret domain style addresses to IP addresses 


to still find out what the name of a machine is. This program is called 
"nslookup" and is usually found in the Unix operating system (at least, I 
haven’t used it anywhere else -- it might only work on Unix). 


"nslookup" stands for Name Server Lookup (there has been some debate, it seems, 
if a domain server is really a name server, or visa versa; in fact, both 
describe what they do well enough to have conflict). Regardless, let’s go 
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ahead and work on learning how to use nslookup. 


[lycaeum] [2]> nslookup 
Default Name Server: 
Address: 66.6.66.6 


Now, 
on poor old Unisys, 


we are after aren’t 


> server kauai.mcl.unisys.com 
kauai.mcl.unisys.com 


Default Server: 


Address: 128.126.180.2 
Okay, now we hav 
by the way. 


takes for it 


to execute commands. 


lycaeum.hfc.com 


going back to that NIC information w 
which is giving up its info 
determined that the kauai.mcl.unisys.com was a domain server, 
ahead to that by changing our server to their server 
on our machine). 


connected to the server. 


arlier, 
very step w 


got 


make. W 
so let’s 
(after all, 


to get this information off of a nameserver. 


Let’s start off by having it give us a 


this server knows. "Everything" 
If we come up with nothing, 


can’t go wrong. 


basic command to list machines 


> ls unisys.com 
[kauai.mcl.unisys.com] 
Host of domain name 
unisys.com 
burdvax.prce.unisys.com 
unisys.com 


kronos.nisd.cam.unisys. 


unisys.com 
kauai.mcl.unisys.com 
unisys.com 
io.isf.unisys.com 
reston.unisys.com 


aviary.star.reston.unisys.com 
aviary.star.reston.unisys.com 


reston.unisys.com 
kauai.mcl.unisys.com 
rosslyn.unisys.com 


aviary.stars.reston.unisys.com 
aviary.stars.reston.unisys.com 


rosslyn.unisys.com 
kauai.mcl.unisys.com 
rmtc.unisys.com 
rmtcfl.rmtc.unisys.com 
rmtc.unisys.com 
gvlv2.gvl.unisys.com 
sp.unisys.com 
dsslan.sp.unisys.com 
sp.unisys.com 
sys3.slc.unisys.com 
cam.unisys.com 
kronos.nisd.cam.unisys 
cam.unisys.com 
burdvax.prce.unisys.com 
prc.unisys.com 
burdvax.prce.unisys.com 
prce.unisys.com 
kronos.prc.unisys.com 
prce.unisys.com 
walt.prc.unisys.com 
walt.prc.unisys.com 
culv.unisys.com 


is wis 


then that’s what’s availab 
like the Unix directory command. 


com 


-com 


Internet address 


server = burdvax.prc.unisys.com 
128.126.10.33 3600 
server = kronos.nisd.cam.unisys.com 
128.170.2.8 3600 
server = kauai.mcl.unisys.com 
128.126.180.2 43200 
server = io.isf.unisys.com 
128.126.195.20 3600 
server = aviary.stars.reston.unisys.com 
128.126.160.3 3600 
128.126.162.1 3600 
server = kauai.mcl.unisys.com 
128.126.180.2 43200 
server = aviary.stars.reston.unisys.com 
128.126.160.3 3600 
128.5126. 762.1 3600 
server = kauai.mcl.unisys.com 
128.126.180.2 43200 
server = rmtcfl.rmtc.unisys.com 
192.60.8.3 3600 
server = gvlv2.gvl.unisys.com 
128.126.220.102 3600 
server = dsslan.sp.unisys.com 
129.218.32.11 3600 
server = sys3.slc.unisys.com 
129.221.15.85 3600 
server = kronos.nisd.cam.unisys.com 
128.170.2.8 3600 
server = burdvax.prc.unisys.com 
128.126.10.33 3600 
server = burdvax.prc.unisys.com 
128.126.10.33 3600 
server = kronos.prc.unisys.com 
128.170.2.8 3600 
server = walt.prc.unisys.com 
128.126.2.10 3600 
128.126.10.44 3600 


server 


= formal.culv.unisys.com 


jump 


list of everything about Unisys that 
is pretty much a good place to start, 


since 
le. 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


3600 


let’s continue to hack 


the computers 


This isn’t a constant connection, 
It will only establish a connection for the brief instant that it 
It doesn’t require a password or an account 


we 
The 
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formal.culv.unisys.com 192.67.92.30 3600 
culv.unisys.com server = kronos.nisd.cam.unisys.com 3600 
kronos.nisd.cam.unisys.com 128.170.2.8 3600 
slc.unisys.com server = sys3.slc.unisys.com 3600 
sys3.slc.unisys.com T29: 221.579 5'.85 3600 
slc.unisys.com server = dsslan.sp.unisys.com 3600 
dsslan.sp.unisys.com 129.218.32.11 3600 
slc.unisys.com server = nemesis.slc.unisys.com 3600 
nemesis.slc.unisys.com 128.221.8.2 3600 
bb.unisys.com server = sunnc.wwt.bb.unisys.com 3600 
sunnc.wwt.bbs.unisys.com 192.39.41.2 3600 
bb.unisys.com server = burdvax.prc.unisys.com 3600 
burdvax.prc.unisys.com 128.126.10.33 3600 
isf.unisys.com server = orion.ISF.unisys.com 3600 
orion. ISF.unisys.com V28:2-12 61 9527 3600 
isf.unisys.com 128.126.195.1 3600 
isf.unisys.com server = burdvax.prc.unisys.com 3600 
burdvax.prc.unisys.com 128.126 .10:.33 3600 
isf.unisys.com server = io.isf.unisys.com 3600 
io.isf.unisys.com 128.126.195.20 3600 
gvl.unisys.com 128.126.220.102 172800 
gvl.unisys.com server = gvlv2.gvl.unisys.com 3600 
gvlv2.gvl.unisys.com 128.126.220.102 3600 
gvl.unisys.com server = burdvax.prc.unisys.com 3600 
burdvax.prc.unisys.com 128.126.10.33 3600 
mcl.unisys.com 128.126.180.2 43200 
mcl.unisys.com server = kauai.mcl.unisys.com 43200 
kauai.mcl.unisys.com 128.126.180.2 43200 
mcl.unisys.com server = burdvax.prc.unisys.com 43200 
burdvax.prce.unisys.com 128.126.10.33 3600 
mcl.unisys.com server = kronos.nisd.cam.unisys.com 43200 
kronos.nisd.cam.unisys.com (dlen = 1152?) 4096 
ListHosts: error receiving zone transfer: 
result: NOERROR, answers = 256, authority = 0, additional = 3. 


Bummer, an error. Funny, it claims there isn’t an error, yet it screwed up the 
kronos address and knocked me out. Apparently, this domain server is screwed. 
Oh well, I guess that’s really their problem because in the information it gave 
us, it was able to provide all the answers we needed to figure out the next 
step! 


Quick analysis of the above information shows that most of the servers wer 


connected to at LEAST two other servers. Quite impressive: A fault-tolerant 
TCP/IP network. Since it is fault tolerant, we can go ahead and use a 
different machine to poke into the "mcl.unisys.com" domain. Since "mcl" stands 


for McLean, that’s where we want to go. 


Remember that NIC told us that kauai.mcl.unisys.com had an alias? It was also 


called "mcl.unisys.com". Looking at the above list, we see toward the bottom 
that mcl.unisys.com is also domain served by the computers 
burdvax.prc.unisys.com and kronos.nisd.cam.unisys.com. Let’s connect to one of 


them and see what we can gather! 


Whenever a server starts acting screwy like kauai was doing, I make it a habit 
of using IP numbers when they are available. I’m going to connect to 
burdvax.prc.unisys.com through its IP address of 128.126.10.33. 


> server 128.126.10.33 
Default server: [128.126.10.33] 
Address: 128:.1426.L0333 


Now that we are connected, let’s s the network information again, but this 
time let’s try something different and possibly more useful. This time we will 
use the -h command, which happens to describe the computer type (CPU) and the 
operating system it runs on (OS) which will give us a better idea of what we 
are dealing with. 


> ls -h mcl.unisys.com 
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Host or domain name CPU OS 

maui.mcl.Unisys.COM SUN-2/120 UNIX 43200 
cisco.mcl.Unisys.COM CISCO GATEWAY CISCO 43200 
kauai.mcl.Unisys.COM SUN-3/180 UNIX 43200 
voyager.mcl.Unisys.COM SUN-4/330 UNIX 43200 
dial.mcl.Unisys.COM SUN-3/260 UNIX 43200 
astro.mcl.Unisys.COM SUN-3/60 UNIX 43200 
hotrod.mcl.Unisys.COM Unisys 386 SCO/UNIX 43200 
oahu.mcl.Unisys.COM VAX-11/785 UNIX 43200 
lanai.mcl.Unisys.COM SUN-3/160 UNIX 43200 
mclean_is.mcl.Unisys.COM 386 NOVELL 43200 

WoW! Look at all those Suns! I guess Unisys has no faith in their own 
computers or something! If only President Bush could see this display of a 
company backing their product! In fact, the only Unisys computer in this whole 


lot is a cheesy 386 clone which probably is some guy’s desktop machine. 


Once again, there is some fascinating information here. Let’s run through it 
really quick: 


Maui is a Sun 2, which is a really old RISC computer. You don’t see many of 
these around but they still can be useful for storing stuff on. But then 
again, it probably is faster than a PC! 


Oahu is a Vax-1l which is apparently running Ultrix. This may be where Unisys 
hoards all their programmers since it isn’t being used for serious networking 
(at least, as far as we can tell). 


Mclean_is happens to be the file server for a PC network. We can’t really tell 
from this point how many computers are on this network, but it could be 
possible it is used for public information trade, where secretaries or 
receptionists use it to confirm trade and scheduling. 


Hotrod is also a 386, made by Unisys even! Oddly, it is running a copy of SCO 
Unix, which means it is, no doubt, a personal computer someone uses for Unix 
programming. If Unisys were itself a part of the government, I’d think this 
computer would have been a kludged bidding contract which they got stuck with 
because they were aiming for lowest bid and were unfortunately not very picky. 


Voyager is an interesting machine, which is apparently the most modern on this 
network. Since it is a Sun-4 computer (probably IPX) it would be a high-speed 
graphics workstation. This could be the machine where many CAD applications 
are stored and worked on. Another possibility is that Sun 4 computers were 
xtremely expensive when they purchased this network of Suns, and they 
purchased this one machine to be the file server to the other Sun 3s and the 
Sun 2. If you were to gain access to one of the other machines, it’s possible 
you would have access to all of them. 


Cisco is just a standard Cisco Router/Gateway box, linking that particular 
network to the Internet. 


Kauai is a messed up domain server, big deal. It might work on the same 
network as Astro and Lanai. 


Dial is a Sun-3. Is there something in a name? This could be the 
telecommunications dial-in for the network. Maybe the same computer system has 
a dialout attached to it. It might even be possible that "dial" has a guest 
account for people logging in so that they can easily connect to other 
computers on the same network (probably not). 


Astro and Lanai are also Sun 3 computers. It isn’t quite obvious what their 
purpose is. Essentially, we have the impression that they were all purchased 
about the same time (explaining the large number of Sun-3 computers in this 
network) and it is quite possible they are just linked up to the Sun 4 in a 
file sharing network. It is also possible they are older and fundamental to 
the operation of Unisys’s communication platform at this particular site. 
There is one flaw that makes using the -h switch somewhat unreliable: 
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Sometimes people realize you can do this and take the time to remove or never 
include the information about the individual machines on the network. 
Therefore, it is always best for you to do a "ls <domain>" and check everything 
out in case a computer has been removed. Using "telnet" to connect to the 
computer is usually a foolproof method of finding out what computer it is they 
are talking about. 


> ls mcl.unisys.com 
[[128.126.10.33]] 
Host or domain name Internet address 
mcl.Unisys.COM server = kauai.mcl.unisys.com 3600 
kauai.mcl.unisys.com 128:°1262180:.2 3600 
mcl.Unisys.COM server = burdvax.prc.unisys.com 3600 
burdvax.prc.unisys.com 128.126.10.33 3600 
mcl.Unisys.COM server = kronos.nisd.cam.unisys.com 3600 
kronos.nisd.cam.unisys.com 128.170.2.8 3600 
mcl.Unisys.COM 128.126.180.2 43200 
maui.mcl.Unisys.COM 128.126.180.3 43200 
cisco.mcl.Unisys.COM 128.126.180.10 43200 
kauai.mcl.Unisys.COM 128.126.180.2 3600 
voyager.mcl.Unisys.COM 128.126.180.37 43200 
dial.mcl.Unisys.COM 128.126.180.36 43200 
LOCALHOST.mcl.Unisys.COM 127.0.0.1 43200 
astro.mcl.Unisys.COM 128.126.180.7 43200 
hotrod.mcl.Unisys.COM 128.126.180.125 43200 
oahu.mcl.Unisys.COM 128.126.180.1 43200 
lanai.mcl.Unisys.COM 128.126.180.6 43200 
mclean_is.mcl.Unisys.COM 128.126.180.9 43200 
Well, running down the list, it appears that there aren’t any more computers 
important to this domain that we don’t know already. LOCALHOST is just another 
way of saying connect to where you are, so that isn’t a big deal. Hotrod being 
separate from the rest of the machines seems apparent since its IP address is 
x.x.x.125, which is quite separate from the others. Even though this doesn’t 
have to be, it seems it is a wiring kludge -- probably for an office like I 
surmised. 


The next step? Go ahead and hack away! This is where all those system hacks 
people trade on the net and all those CERT Advisories become useful. If you 
become good hacking a single machine (Suns, for example), using nslookup will 
help you identify those machines and make it easier for you to hack. 


Looking for annex computers, libraries, guest machines, and other such 
computers also becomes easy when you use nslookup, because the names and 


computer types are there for your convenience. Checking on sites by selecting 
interesting "special purpose" machines with nslookup first can yield good 
results. People have called this "netrunning," and it sounds like as good a 


hame as any. 


Of course, the other big problem when dealing with domain servers is trying to 
identify them. The largest list of domain servers can be found off of the 
Department of Defense Network Listing (usually called hosts.txt) which is 
available almost everywhere on the Internet through anonymous FTP. Here is a 
rundown on how to get the file: 


[lycaeum] [3]> ftp wuarchive.wustl.edu 


220 wuarchive.wustl.edu FTP server (Version 6.24 Fri May 8 07:26:32 CDT 1992) 


ready. 
Remote host connected. 
Username (wuarchive.wustl.edu:rack): anonymous 


331 Guest login ok, send your complete e-mail address as password. 
Password (wuarchive.wustl.edu:anonymous) : 


230- This is an experimental FTP server. If your FIP client crashes or 
230- hangs shortly after login please try using a dash (-) as the first 
230- character of your password. This will turn off the informational 


230- messages that may be confusing your FTP client. 
230- 
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230- This system may be used 24 hours a day, 7 days a week. The local 
230 time is Wed Jun 3 20:43:23 1992. 

230- 

230-Please read the file README 
230- it was last modified on Mon Mar 2 08:29:25 1992 - 93 days ago 
230-Please read the file README.NFS 

230- it was last modified on Thu Feb 20 13:15:32 1992 - 104 days ago 
230 Guest login ok, access restrictions apply. 


ftp> get /network_info/hosts.txt 
200 PORT command successful. 

150 Opening ASCII mode data connection for /network_info/hosts.txt (1088429 bytes). 
226 Transfer complete. 

Transferred 1109255 bytes in 182.95 seconds (6063.29 bytes/sec, 5.92 KB/s). 


ftp> quit 
221 Goodbye. 


Now let’s convert it to a file we can use effectively: let’s take out of that 
huge list of only the machines that are domain servers: 


[lycaeum] [4]> grep -i domain hosts.txt > domains 


Okay, now that we have done that, let’s prove that this is a way of finding a 
domain server without connecting to anyplace. Let’s just use the grep command 
to search the file for a server in the mcl.unisys.com domain: 

[lycaeum] [5]> grep -i mcl.unisys.com domains 

HOST : 128.126.180.2 : KAUAI.MCL.UNISYS.COM,MCL.UNISYS.COM : SUN-3/180 
S) 

[ 


UNOS : TCP/TELNET, TCP/FTP, TCP/SMTP, UDP/DOMAIN 


lycaeum] [6]> 


And there you have another way. Everything we looked at is here: IP number, 
the name, the "alias," the computer type, the operating system, and a brief 
list of network protocols it supports, including the domain server attribute. 
However, none of the other machines on the mcl.unisys.com network were 
displayed. The DoD isn’t a complete list of network machines, only the network 
machines that are vital to the functioning of the Internet (in the last year, 
this list has grown from about 350K to 1.1 megabytes -- and this only reflects 
the "new" networks, not including the addition of new machines onto old 
networks; the Internet is definitely "in;" I believe it was estimated 25% 
growth per month!). 


Obviously, this is very effective when going after university sites. It seems 
they have too many machines to take good care of security on. Essentially, the 
DoD list contains much the same information as NIC does, and is about a million 
times more discreet. I’m not sure if NIC is fully logged, but it does have a 
staff Head of Security (*snicker*). 


Well, that will pretty much wrap it up for this file. Hope some of it was 
useful for you. 
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==Phrack Inc.== 
Volume Four, Issue Forty, File 5 of 14 
Pirates Cove 
By Rambone 
Welcome back to Pirates Cove. My apologies for not providing you with this 
column in Phrack 39. However, in this issue we take a look at some recent 
busts of pirate boards and the organization most to blame for it all... the 


Software Publishers Association. Plus we have news and information about 
Vision-X, game reviews, BAD Magazine, and more. Enjoy. 


FBI Raids Computer Pirate; SPA Follows With Civil Lawsuit June 11, 1992 


BOSTON -—- The Federal Bureau of Investigation raided [on June 10] "Davy Jones 
Locker," a computer bulletin board located in Millbury, Massachusetts, which 
has allegedly been illegally distributing copyrighted software programs. 


The Davy Jones bulletin board was a sophisticated computer bulletin board with 
paying subscribers in 36 states and 11 foreign countries. 


A computer bulletin board allows personal computer users to access a host 
computer by a modem-equipped telephone to exchange information including 
messages, files, and computer programs. The system operator (or sysop) is 
generally responsible for materials posted to the bulletin board. 


For a fee of $49 for three months or $99 for one year, subscribers to Davy 
Jones Locker were given access to a special section of the bulletin board that 
contained copies of more than 200 copyrighted programs including popular 
business and entertainment packages. Subscribers could "download" or receive 
these programs for use on their own computers without having to pay the 
copyright owner anything for them. 


The business programs offered were from a variety of well-known software 
companies, including: AutoDesk, Borland International, Broderbund, Central 
Point System, Clarion Software, Fifth Generation, Fox Software, IBM, Intuit, 
Lotus Development, Micrografx, Microsoft, Software Publishing Corp., Symantec, 
Ventura Software, WordPerfect and X-Tree Co. Entertainment programs included 
Flight Simulator by Microsoft, and Leisure Suit Larry by Sierra. 


Seized in the raid on Davy Jones Locker were computers, telecommunications 
equipment, as well as financial and other records. 


"The SPA applauds the FBI’s action today," said Ilene Rosenthal, director of 
litigation for the Software Publishers Association (SPA). "This is one of the 
first instances that we are aware of where the FBI has shut down a pirate 
bulletin board for distributing copyrighted software. It clearly demonstrates 
a trend that the government is recognizing the seriousness of software 
copyright violation. It is also significant that this week the Senate passed 
S.893, a bill that would make the illegal distribution of copyrighted software 
a felony." 


For the past four months, the Software Publishers Association has been 
investigating the Davy Jones Locker bulletin board and had downloaded business 
and entertainment programs from the board. The programs obtained from Davy 
Jones Locker were then cross-checked against the original copyrighted 
materials. In all cases, they were found to be identical. 


Subscribers to Davy Jones Locker not only downloaded copyrighted software, but 
were also encouraged to contribute additional copyrighted programs to the 
bulletin board. 


The system operator limited subscribers to four hours on the bulletin board 
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each day. He also limited the amount of software a subscriber could download 
to his or her own computer each day. Those who "uploaded" or transmitted new 
copyrighted software to the bulletin board for further illegal distribution 
were rewarded with credits good for additional on-line time or for additional 
software. 


"Imagine a video store that charges you a membership fee and then lets you 
make illegal duplicates of copyrighted movies onto blank video tapes," 
explains Ilene Rosenthal, SPA director of litigation. "But it limits the 
number of movies you can copy unless you bring in new inventory -- copies of 
new movies not already on the shelves. That was the deal at Davy Jones 
Locker." 


Davy Jones Locker was an international concern with paid subscribers in the 
United States and 11 foreign countries including Australia, Canada, Croatia, 
France, Germany, Irag, Israel, Netherlands, Spain, Sweden and the United 
Kingdom. 


Whether it’s copied from a program purchased at a neighborhood computer store 
or downloaded from a bulletin board thousands of miles away, pirated software 
adds to the cost of computing. According to SPA, software pirates throughout 
the world steal between $10 and $12 billion of copyrighted software each year. 


"Many people may not realize that software prices are higher, in part, to make 
up for losses to the pirates," says Ken Wasch, executive director of the SPA. 
"Pirate bulletin boards not only distribute business software, but also hurt 
the computer game publishers by distributing so many of their programs 
illegally. In addition they ruin the reputation of the hundreds of legitimate 
bulletin boards which serve an important function to computer users." 


The Software Publishers Association is the principal trade association of the 
personal computer software industry. Its 900 members represent the leading 
publishers in the business, consumer and education software markets. The SPA 
has offices in Washington, D.C., and Paris La Defense, France. 


CONTACT: Software Publishers Association, Washington, D.C. 
Terri Childs or Ilene Rosenthal, 202/452-1600 


PC Bulletin Board Hit by FBI Raid June 14, 1992 


By Josh Hyatt (Boston Globe) (Chicago Tribune, Section 7, Page 3) 


BOSTON -- In one of the first reported crackdowns of its kind, six FBI agents 
raided a computer bulletin board based in a Millbury, Massachusetts, home last 
week. Authorities said the bulletin board’s operator had been illegally 
distributing copyrighted software. 


Executing a criminal search warrant, the agents seized several computers, six 
modems and a program called PC Board, which was used to run the bulletin board. 
Authorities also seized documents that listed users of the service. 


No arrests were made, according to the Software Publisher’s Association, a 
trade group that brought the case to the FBI’s attention. The association 
estimates that, as of March, the bulletin board had distributed $675,000 worth 
of copyrighted software; software pirates, it says, annually steal as much as 
$12 billion this way. 


The FBI will not comment on the case except to confirm that a raid had taken 
place and that the investigation is continuing. The alleged operator of the 
bulletin board, Richard Kenadek, could not be reached for comment. 


Around the same time as the raid, the software association filed a civil 
lawsuit against Kenadek, charging him with violating copyright laws. Ilene 
Rosenthal, the group’s director of litigation, said that "the man had 
incriminated himself" through various computerized messages. 


"There’s plenty of evidence to show that he was very aware of everything on his 
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bulletin board," she said. 


Bulletin boards let personal computer users access a host computer via modems. 
Typically, participants exchange information regarding everything from computer 
programs to tropical fish. They may also, for example, obtain upgrades of 
computer programs. 


The association said its own four-month investigation revealed that this 
bulletin board, called Davy Jones Locker, contained copies of more than 200 
copyrighted programs. 


Rosenthal said users also were encouraged to contribute copyrighted software 
programs for others to download or copy. 


According to Rosenthal, subscribers paid a fee, $49 for three months or $99 for 
one year. She said Davy Jones Locker had nearly 400 paying subscribers in 36 
states and 11 foreign countries. 


Cracking Down On Computer Counterfeiters July 1992 


Popular bonding rituals usually aren’t criminal. Admire a friend’s new car, 

and you’re likely to swap a few stories and a can of STP. You may be invited 
to take the car for a spin. You can pass recipes back and forth or lend your 
copy of the latest best-seller to a fellow fan. 


Sharing computer programs is another common practice among friends. It’s 
great to help someone who’s daunted by the challenge of learning to use a new 
machine, and sometimes that includes a gift of some of your favorite software. 
"Here. Why don’t you get started with WordPerfect?" And, later, inevitably, 
"The Norton Utilities will get that file back for you." 


Copying a set of disks is so simple and such a private action that you’d hardly 
think it’s also illegal. The legality part is easy to overlook. The copyright 
notice is a complicated critter, often printed on the seal of the software 
package that is torn away as you dig for those floppy disks. You may not even 
be the one who ripped the original package open (in which case, you’re yet 
another who’s ripped the program off). 


But whether or not you’re aware of it, unless you either broke the shrink-wrap 
or received the package with all disks, documentation, and licensing 
information intact, you’re breaking the law. The good news is that if you’re 
an individual with pirated software on your home computer, you probably won’t 
get caught. But if you’re a boss with an angry employee, the Software 
Publishers Association (SPA) may get tipped off. When the SPA comes to call on 
your business, it’s with U.S. marshals and lots of official paperwork. And the 
association has an annoyingly good history of winning its copyright-— 
infringement cases. 


Perspectives on Piracy 


"Computers give us a kind of technical sophistication that never used to 
exist," says Ken Wasch, the voluble head of the SPA. "In the old days, if you 
wanted to make your own copy of something like a pencil, you’d need a 
complicated manufacturing center. But the very fact that you can run a 
computer program means that you can make a flawless copy of it. This is the 
only industry in the world that empowers every customer to be a manufacturing 
subsidiary." 


The regulations are spelled out again and again in the software manuals: 
You’re allowed to make one or two copies of the program for backup purposes. 
Other rules vary slightly from company to company. Some license agreements 
demand that the software package be used only with a single machine; others, 
most notably Borland’s, let you use the program on as many computers as you 
wish, provided no two copies of the program are run concurrently, just as a 
book can be read by only one person at a time. 
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"If all software developers took the same approach as Borland International, 
people wouldn’t steal so much," says avowed pirate Ed Teach. 


(Note: The names and locations of all interviewed pirates have been changed.) 
"Borland gives you that book license. Of course, they’1l drive you insane with 
upgrades. They wholesale the software, then make their money on all the 


subsequent releases." 


Teach is the systems administrator for a residential health-care company in 
the Southeast. "I believe in piracy," he says. "I like to borrow something to 
play with it. If I like it, I’1l buy it." 


He dismisses demos and limited versions of programs as inadequate for the 
testing he prefers; similarly, he considers the typical 30-day return agreement 
too restrictive. "It’s not a realistic time period for an evaluation," Teach 
says. "I just got a copy of FormTool Pro, and it’s a powerful program with a 
very steep learning curve. I can’t devote myself to it and learn what I’d need 
to know in 30 days." 


Teach has spent six years recommending and configuring programs for his 
company. He does not fit the image of a lawbreaker, and he believes that what 


he does is morally justified. "I buy the software eventually. My company 
bought licenses to use WordPerfect 5.1 after starting with a pirated copy of 
the program. Everything on the company machines is legit." 


Copying wasn’t always so easy. Old-timers remember the copy-protection schemes 
that pervaded the computer industry, requiring key disks or special 
initialization procedures. But users unanimously demanded an end to it, and 
when Lotus, the last significant holdout, gave in, that era was over. Today 
you find protection only on games and niche-market programs. 


How much has the end of copy protection cost software companies? It’s 
impossible to figure accurately. In August 1991, the indefatigable Software 
Publishers Association released figures on corporate-use losses that suggest 


both a staggering financial loss and a possible decline in piracy. In 1987, 
1.31 DOS-based software programs were sold for every office computer. The 
expected proportion is three packages per computer, meaning that more than half 
of the programs in use were probably pirated. In 1990, the number of 


legitimate packages jumped to 1.78. But prices have gone up, too, so that the 
dollar losses haven’t changed much: The 1987 liability was $2.3 billion, and 
the number rose to $2.4 billion in 1990. 


The numbers for private-use piracy, on the other hand, can’t be calculated. If 
all the computer users who have never pirated software got together, they 
wouldn’t need a very large hall. Wasch concedes that it’s difficult to 
actually catch and prosecute the individual pirate. "Nobody is actually doing 
time for piracy," he says, citing the exception of a retailer who was caught 
running what amounted to a pirated-software storefront. 


The Software Police 


Although the SPA is targeting home abuse in a current study, Wasch believes 
that the greatest financial losses are due to corporate piracy. And corporate 
pirates are easier to apprehend because an angry employee is frequently willing 
to turn in the boss. "We get about 20 calls a day," says Wasch, who set up a 
special number (800-388-7478) for reporting piracy. "Ninety percent of the 
calls we follow up on come from disgruntled employees." 


It’s the kind of visit most of us have only seen in the movies, and it’s 
usually an unexpected one. A receptionist with one targeted company was so 
shocked by the arrival of the SPA posse that she asked if it was a "Candid 
Camera" stunt. 


Founded in 1984 as an educational and promotional group, the SPA evolved into 
a software police force five years ago as more and more software vendors 
joined. Now almost 800 are in the fold. The SPA began to woo whistle-blowers 
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in earnest about two years ago, after a tip led to the successful bust of a 


large corporation in the Midwest. 


"Business is too good," Wasch says. "We’re doing far more lawsuits and far 
more audits than ever before, and the numbers are continuing to grow." 


If your corporation is busted by the SPA, hope that it’s done by mail. "What 
happens then is that we write the CEO a letter explaining that we want to do an 
audit," Wasch says. "If we find illegal software, the company pays twice: Once 


for the pirated copy, once for a new one. 


"That’s a lot better for the company. The fine is much lower, and they don’t 
face the adverse publicity that results from a lawsuit. Still, 60 percent of 
them promise they won’t destroy software before they report it, and then they 
go and do it anyway." 


That was the case with a recent SPA visit to a medium-size defense contractor 
in Washington, DC. "They agreed to an audit, and then they tried to wipe 
pirated programs off all the hard disks," Wasch says. "But we knew. Why do 
they think we called them in the first place? Someone on the inside was 
talking. I couldn’t believe they’d sit there and lie to us about it, we had 
them over a barrel!" 


The increasingly ominous specter of the SPA breaking down the door is making 
more companies go legit, but some continue to spout excuses. "I don’t want to 
break the law, but I also don’t want to go out of business," says Howell Davis, 
the CEO of an accounting firm in a New England capital. "We can’t afford to 
work without computers, but I can’t pay the high price of registering every 
copy of every program we use. I had to borrow a lot of money to get this 
business off the ground, and I think of this as just another form of borrowing. 
It’s another loan I’1l repay when I can afford to." 


Some corporate pirates operate with a sense of entitlement. 


"Nobody’s going to catch us," says Charles Vane, the managing director of a 
nonprofit theater company in the Northwest, "and nobody should even be trying 
to. We’re on the brink of bankruptcy. Companies should be giving us software 
packages as a gesture of support for the arts." He admits that almost all of 
the software his theater uses is pirated. "We have some nice programs, 
including an accounting package developed for Ernst & Young that we swiped and 
a copy of SuperCalc with a bunch of extra modules. And WordPerfect, of 
course," Vane says. 


Where do the packages originate? "Our board members get them for us," Vane 
says. "Of course, that means we can’t be choosy. We have to wait until a 
particular program comes our way. And what they like to give us the most are 
games. We have a kazillion games." 


Games and piracy are natural partners. Games themselves encourage piracy. 
Unlike business-oriented programs, they engender intense, short-lived 
relationships. Or as pirate-BBS operator John Rackam puts it, "Games get 
boring. That’s why you see so many of them on the pirate boards." 


Online Piracy 


Rackam runs a BBS straight out of "The Man from U.N.C.L.E." It looks like any 
other medium-size board in the country, with a standard collection of shareware 
and message bases. Gain special access which only takes $50 and a friend’s 

ecommendation and you pass through the secret door into a 600MB collection of 


Lr 
the latest applications, including 10 zipped files of the complete dBASE IV, 11 
of AutoCAD, and 6 of MS-DOS 5.0. 


"Most of the people who use my board are collectors," he says. "They have to 
have the latest copy of everything." Rackam isn’t deterred by the threat of 
getting caught. "I don’t think it’s going to happen to me. I’m not doing 
anything that’s really terrible. I mean, I’m not hacking up bodies or 
anything. I make no money off this. The fee is just for keeping up my 
equipment. I consider myself a librarian." 
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Novell takes a dim view of that attitude, as evidenced by an August 1991 raid 
of two California bulletin board systems accused of distributing Novell NetWare 
files. Such systems are another target the SPA would like to hit, and Wasch is 
looking for FBI cooperation. 


That makes the Humble Guys Network ripe for the picking. Study the high- 
resolution GIF file of these buccaneers, and you see a collection of ordinary- 
looking folks who happen to traffic in pirated game software. The founder, a 
hacker who called himself Candy Man, has since skipped the country; now The 
Slave Lord, a student at a southern college, is at the helm. 


"The whole point of the network is to get games before the stores have them," 
says Bill Kidd, a computer consultant in Manhattan. "This is like proof of 
manhood, how fast you can get them." Kidd professes little personal 
involvement with piracy, but he knows where the bodies are buried. 


"First there are the suppliers who can get a program from a manufacturer well 
before it’s released," Kidd says. "Often the supplier works for the 
manufacturer. The game goes to the head person, who delivers it to the 
crackers. They’re the ones who remove the copy protection. From there it goes 
to the couriers, and each has a list of pirate BBS’s. The program then makes 
it all over the country in minutes." 


Speed is an obsession. These pirates are armed with 9,600-bit-—per-second 
modems and a must-have-it-now mentality. "The week before MS-DOS 5.0 hit the 
stores," says Kidd, "most of the pirate boards had already deleted it because 
they had been offering beta versions six months before." 


As far as revenues are concerned, pirate bulletin boards may be more of a 
nuisance than a threat. "Those people are never really going to buy that 
software," says John Richards, a product manager with Lotus. "Nominally, it’s 
bad, but it’s not as if they’re buying one copy of 1-2-3 to put on the office 
workstation for ten users." 


Pirates at Home 


While an office environment allows for regular, rigorous audits, the home 
user gets away with pirating software. Peer under the hoods of a few hard 
disks, and you’re liable to find something illicit. 


"It can happen innocently enough," says Symantec’s Rod Turner. As general 
manager of the Peter Norton Group, Turner has the distinction of overseeing one 
of the most frequently pirated pieces of software: The Norton Utilities. 
"Someone puts a copy of the software on someone else’s machine to test it out 
and leaves it behind. The other user assumes it’s there legitimately," Turner 
says. 


"Often, someone gets software from a friend who got it at work," says Tony 
Geer, service manager at Computer Directions, a retail outlet in Albany, New 
York. Geer looks at hundreds of user-configured hard disks every month. 
"Someone buys a machine from us, then turns around and calls us to say that 
he’s got all this software now, could we tell him how to run it," Geer says. 
"What am I supposed to do? The customer wants me to spend hours on the phone 
teaching him or he gets mad. When I tell him he has to buy the program, too, 
he gets annoyed." 


Geer also receives a huge number of requests for pirated software. "A lot of 
users think that we can load up their hard disks with programs, even though 
they know they ought to be paying for them and just want to duck the fee." 


A few requests come from the truly naive, Geer says. "I’1l get a call for 
software support and I’1ll ask, What did the manual say?’ I didn’t get a 
manual,’ the person tells me. A friend gave this to me.’ And then I have to 
explain that software isn’t free." 


High software prices are a common user complaint. Former WordPerfect executiv 
vice president W.E."Pete" Peterson thinks the $495 list price of WordPerfect’s 
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best-selling word processing program is justified, however. "WordPerfect sells 
about 150,000 copies a month at that price, so quite a few users think the 
price is justified, too," says Peterson. "A computer costs anywhere from a few 
hundred to a few thousand dollars. Without the software, the computer is 
worthless. WordPerfect goes to a lot of work to write and support the 
software." 


The latter includes a costly policy of toll-free phone support, handled by 
operators who would just as soon not ask for a registration number. It’s an 
expensive way of showing trust, but it has paid off in excellent public 
relations. 


"We try to sympathize with people," says Jeff Clark, public relations director 
at XyQuest, the company that publishes XyWrite, a word processing program 
popular among journalists. "We sell replacement manuals as a service to 
registered users, but there’s a call at least once a week from someone who’s 
obviously trying to get manuals to go with a pirated copy." 


The challenge then is to educate the caller, who may not even know that a law 


has been broken. "All we ask of a registered user is to run the program on one 
machine at a time," Clark explains. "If you’re using it at work, yes, you can 
use it at home. But don’t buy one copy to use in an office of eight people." 


"A lot of people seem to think copying disks is OK because it’s easy to do," 
says Turner, who is also chairman of the SPA’s companion organization, the 
Business Software Alliance, which fights international piracy. "Then they call 
our tech line, and we’re in the delicate position of telling them they’re using 
a product illegally." 


Microsoft is even more benevolent. "We like to know where the pirated copy 
originated," says Bill Pope, associate general counsel for the company. "It’s 
not always possible to learn over the phone who’s pirating something, because 
we don’t require that registration cards be returned. But if we do identify a 
pirated copy, we’ll help the user get it legally, and we may even supply a free 
copy of the program if we can learn where it came from." 


A highly publicized amnesty program was launched by the XTree Company in July 
of 1982. For $20, anyone with a pirated copy of an XTree program was allowed 
to buy a license for th ntry-level version of the program, thus getting 
access to the upgrade path. Response was enthusiastic during the 90-day 
period, but the offer won’t be repeated. "You can’t offer amnesty over and 
over," says Michael Cahlin, who markets the XTr products. "You lose the 
respect of dealers and users who paid full price for it." 


Turner is more blunt about it. "Amnesty encourages piracy. I don’t think it’s 
been successful." 


While the SPA will continue to make headlines with Untouchables-style raids 

of corporate offices, Wasch also acknowledges that education is the key to 
fighting piracy. A 12-minute, SPA-produced videotap ntitled It’s Just Not 
Worth the Risk spells out the message as a congenial corporate manager is made 
wise to the ways of the company pirate. 


"That tape has been a huge success," says Wasch. "American Express bought 300 
copies, and Kimberly-Clark just ordered 100. We’ve distributed about 10,000 of 
them so far." 


A self-audit kit, also available from the SPA, includes a program that 
determines what software is in use on your PC as well as sample corporate memos 
and employ agreement forms to promote piracy awareness. 


Seeing the Light 


Fear of being caught keeps many people honest, but some pirates will wait until 
they’ re forced to walk the plank before giving up. 


John Rackam says his BBS users are innocent. "They can’t afford the software, 
and they shouldn’t have to pay," he says. "They’re downloaders. They un-ARC it and say, 
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his is nice!’ Then th never use it again." 
y 


Charles Vane believes that software companies should give nonprofit 
organizations like his theater a break. "If they give us packages, we’ll give 
them publicity. We’1ll print it in the program, we’ll post it in the lobby. 
It’s an upscale crowd that comes through here. We just don’t have the luxury 
of money. I bought one program, ReportWriter, because it was cheap and good." 


For casual users, piracy may simply be a phase. "I own 90 percent of the 
programs I use," says systems administrator Ed Teach. "That’s a big reverse 
from about four years ago, when 90 percent of them were bootlegs." 


And there’s always the problem of well-meaning friends. Henry Every, a 
journalist at a Florida newspaper, received pirated programs from friends when 
he bought his first computer five years ago. 


"IT had all these programs and no idea how to use them," Every says. 
"Fortunately, the bookstore had guides that wer ven better than the manuals, 
and I became something of a power user. Then I became the guy that a friend of 
a friend would call for help with his machine. Next thing I know, I’m the one 
giving away pirate copies. 


"But I won’t do it anymore. I’m sick and tired of getting those calls all hours 
of the day and night asking me how to use the damn things." 


No Excuses Accepted 


"When I’m sitting across the table from them and they’re looking really 
dog-faced, when I can see the whites of their eyes, it’s hard to pull the 
trigger," says Ken Wasch, the head of the Software Publishers Association. 
"Nevertheless," he says, "I pull the trigger." 


Wasch is not a tender man when it comes to dealing with software pirates. He 
has no patience for the typical excuses given by those who copy and use 
unlicensed software, and he offers the following responses to the common 
complaints he hears from the outlaws: 


a The price is too high. 


"Hey I don’t own a Mercedes Benz. Why? The price is too high. If you can’t 
afford it, don’t use it." 


ai It’s better to test the real thing than a crippled or demo version. 

"The demos are normally very good. They limit the number of records, or they 
don’t save to the disk, or something. It’s enough." 

° I’1ll pay for it later. 

"I doubt it." 

S I won’t get caught. 


Wasch laughs. When he does so, you can’t help but hope that he’s laughing with 
you, not at you. "Sooner or later..." 


How Microsoft Foiled the Pirates 


Imitation is flattering only when you don’t lose money over it. Many software 
packages are copied by clever pirates who duplicate disks, manuals, even 
packaging. Microsoft has been hit often enough by counterfeiters that recent 
software releases, including the Windows 3.1 and MS-DOS 5.0 upgrade packages, 
were specially designed to be bootleg-proof. 


iv 


Every component part was carefully designed or hand-picked for that reason," 
says Kristi Bankhead, who works with Microsoft’s general counsel on piracy 
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issues. "To the user, it should just look like an attractive box, but it 
allows us to tell at once if it’s legitimate or not." 


That strategy paid off in March when FBI agents raided a quartet of Silicon 
Valley companies that were pulling in up to $600,000 a month distributing bogus 
copies of MS-DOS and Windows. 


Key components of the official, bootleg-proof box designs are colorful artwork 
and the use of holograms. On the MS-DOS 5.0 upgrade box, a silver circle on 
the side offers an iridescent image of the logo. A second hologram, a small 
rectangle on the side of the program manual shows through an expensive die-cut 
hole on the other side of the box. The interlocked letters D-O-S are printed 
in a four-color process that results in complicated mixtures that defy 
reproduction. Even the way the box is folded and the flaps are glued and 
tucked is unique, it’s not a common style, and counterfeiters must either spend 
time and money to copy it or risk quick discovery. 


Even as the DOS upgrade package was being readied for market last year, police 
detectives uncovered a Los Angeles based pirate ring that was already working 
on full-scale knockoffs of it. "We got them while they were in the process of 
completing the DOS 5.0 artwork," said Bankhead, "but we could tell how bad it 
would look. For instance, they were using a piece of foil for the hologram, 
and it had no three-dimensional image." 


Top 10 Pirate BBS Downloads 


Windows 3.1 (Microsoft) 


2. Excel 4.0 (Microsoft) 

3. Norton Utilities 6.0 (Symantec) 

4. WordPerfect for Windows 5.1 (WordPerfect) 

5. Stacker 2.0 (Stac Electronics) 

6. AutoMap (AutoMap) 

7. Procomm Plus 2.0 (Datastorm Technologies) 

8. PC Tools Deluxe 7.1 (Central Point Software) 

9. QEMM-386 6.0 (Quarterdeck Office Systems) 

10. WordPerfect 5.1 (WordPerfect) 
It looks familiar. It’s very close to a recent Top 10 list of legitimate 
programs. That’s not surprising, since popular programs are also the most- 


often swiped. 


The list above was compiled from a survey of pirate BBS’s, with help from John 
Rackam. He explains that activity is so brisk the profile changes from week 
to week, with games being the most transitory items (which is why they’re 


impossible to track). Because non-disclosure doesn’t exist in the pirate world 
and exchanging beta copies of software is a pirate tradition, Windows 3.1 won a 
strong position even before its official release. By the way, there’s only a 


cursory interest in OS/2 2.0, which is ominous news for IBM if pirate interest 
is any barometer of sales. 


Software Publishers Association: Nazis or Software Police? 


An Investigative Report by Rambone 


The Software Publishers Association (SPA) is the principal trade association of 
the microcomputer software industry. Founded in 1984 by 25 firms, the SPA now 
has more than 750 members, which include major businesses, consumer and 
education software companies, and smaller firms with annual revenues of less 
than $1 million. The SPA is committed to promoting the industry and protecting 
the interests of its membership. 


The SPA has two membership categories: Full and Associate. Software firms 
that produce, release, develop or license microcomputer software and are 
principally responsible for the marketing and sales of that software are 
eligible to apply for full membership status. Firms that develop software, but 
do not publish are also eligible. Associate membership is open to firms that 
do not publish software, but provide services to software companies. These 
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members include vendors, consultants, market research firms, distributors and 
hardware manufacturers. 


Lobbying 


The SPA provides industry representation before the U.S. Congress and the 
executive branch of government and keeps members up-to-date on events in 
Washington, D.C., that effect them. The fight against software piracy is among 
its top priorities. The SPA is the industry’s primary defense against software 
copyright violators both in the United States and abroad. Litigation and an 
ongoing advertising campaign are ways in which the SPA strives to protect the 
copyrights of its members. 


This is the impression that the SPA wants to give the general public, and for 
the most part, I have no problem with it. During a lengthy conversation with 
Terri Childs of SPA, I was informed of several things. The association’s main 
source of information is from their hot-line and the calls are usually from 
disgruntled employees just waiting to get back at their former bosses. An 
example of this is a company that had bought one copy of Microsoft Works, and 
with over 100 employees, they all seemed to be using the same copy. One 
particular secretary had gotten fired, for what reason I do not know, so she 
called the SPA police and spilled her beans. Once that happened the SPA got 
the balls rolling by instructing the Federal Marshals to get a warrant and 
storm the building like they own the place. With a nifty little program they 
have that searches the machines for illegal copies of the software, they came 
up with the programs not registered to that machine. *Bam!*, caught like a 
dead rat in a cage. The SPA declined to comment on what has happened to that 
company since the raid, but they did say the company would be fined "X" amount 
of dollars for each illegal copy. 


Ms. Childs was very helpful though, she explained the idea behind the 
association, and what they stand for. I was very impressed with what she had 
to say. However, when I brought up the case concerning the Davy Jones Locker 
bust. She told me she was not qualified to answer questions involving that 
case and directed me to Elaine Rosenthat. So a few hours later I called her, 
and for a few brief moments she seemed to be quite helpful, but then decided to 
put me on a speaker phone with the founder of the "Association," Ken Wasch. 


>From the start I knew I would not get a straight answer out of him. The first 
thing I asked him is if someone not in SPA obtained an account to get onto DJL, 
and then gave it to them with log captures from the BBS. He would not give me 

a straight answer, just that SPA was able to obtain the information. I then 
asked him what actions are being taken toward DJL and received another run 
around. 


Finally, I asked what type of fine would be likely to be handed down in this 
case. He refused to give me an answer. 


But I did learn one very interesting little fact from all of this. The money 
obtained by this incident and others like it do not go to the software 
companies who the SPA claims to be protecting. Instead it goes right into the 


coffers of the SPA itself! I guess they like to try those Mercedes. 


And here is a few more interesting little tidbits about the SPA. Not only do 
they fine the companies for having illegal software and then pocket the money, 
but the annual charge for membership on the software companies can range 
anywhere from $700 to $100,000! It seems to me that it is much more profitable 
to eradicate piracy than to participate in doing it. 


For those of you currently operating or considering operating a pirate bulletin 
board, I would suggest that you not charge your users for access. Even if you 

claim that the money is only for hardware upgrades, in the long run, if you get 
busted, the money you collected will be evidence that suggests you were selling 
copyrighted software for financial gain. 


Vision-X Backdoor Nightmare 


5.txt Wed Apr 26 09:43:39 2017 11 
By Rambone 


There seems to be a fallacy in the pirate world that all BBS software is 
untouchable. However, about a month ago a few people associated with the 
Oblivion team took apart .93 (a version number of Vision-X) and found 
backdoors. The unfortunate problem with this is that the V-X team put those 


backdoors in so they could trace down which Beta site was giving out Beta copies. Well, th 
ey found the backdoors and called up several boards and used 
them. 


1. The story from the people who hacked the boards is this, one of the two 
involved was irate becuase he wrote a registration for .93 so anyone could 
run it, whether they paid for the software or not. When the V-X team found 
out about it, they blacklisted him from being able to logon into any V-X 
system. This was done hard-coded, so no sysop could let him in with that 
handle. Anyway, the story is they got into several of the BBSes, and even 
dropped to DOS to look around, but did not have any intentions on 
destroying data. Basically, they wanted to expose the weaknesses of the 
software. The problem started when they posted the backdoors on a national 
net, which means that now any lamer could use this backdoor for their own 
purpose. According to the Oblivion guys, they did not destroy the data, 
but some of the lamers that saw the backdoors on the net did. They regret 
posting the backdoors. They didn’t realize that there are some people who 
are malicious enough to destroy data. 


The Vision-X team are positive that the people who did take down the BBSes 
were the Oblivion team, some say they even admitted to doing it. There is 
a major paradox in these stories, and at this point it doesn’t look like 
anyone will ever be able to get th ntire truth about what had happened. 


Backdoors have never been a good idea, even if the authors are positive they 

will never be found. The recent barrage of system crashing prove that the backdoors will i 
ndeed be found eventually. On the flip side of the coin, even 

if backdoors in BBS software are found, they should be left alone to be used for their orig 
inal intent. Most authors who put the backdoors into the systems 

do it to protect their investment and hardwork. Most BBS programers these days 

work on the software for the benefit of the modem community, and expect a 

little money in return for their hard work. It is wrong for sysops to use it 

without permission. You guys need to stop being cheap asses, and support a 

software you want support from. What is the point of running a cracked piece 

of software since you cannot get support from the authors and not get the net 

they are involved in. The nominal amount of money involved is a good 

investment in the future of your bbs. 


"BAD" Magazine Lives Up To Its Name 


By Rambone 


I had never read Bad Magazine until recently. Everywhere discussion about it 
had erupted, all I saw were comments that it was a waste of harddrive space. 
However, when Bad’s eighth issue surfaced, I heard that there were a few 
disparaging remarks made about me and a spew of other loose information. 


So I went ahead and took a look at it, and what I found was one lie after 
another. I have never seen a magazine so full of shit as BAD #8. Apparently 
they seemed to think I mentioned them in Phrack magazine, "Bad Magazine got 
their first mention in the magazine Phrack." The funny thing is, the only 
mention of BAD Magazine ever to appear in Phrack before now was a remark 
attributed to The Grim Reaper that I reprinted. 


I could care less about a pathetically lame magazine such as BAD and I never 
mentioned them and never intended on mentioning them until they raised the 
issue by taking a pot shot at me. 


"The Boys of Phrack however did not do their homework when mentioning this 
though." This is a quote from BAD regarding comments made about Vision-X, 
which the article was not even about. What they don’t know is that I 
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personally called The Grim Reaper and talked to him before putting anything in 
Phrack about his bust. That’s what the point of the article was about, not 
about some lame magazine named BAD and what they did. They deemed me 
responsible for not backing up my facts, when in fact, I backed them all up. 
Grim Reaper’s comments about Vision-X was not my concern, it was his bust for 
credit card abuse that I was interested in learning about. The remarks 
concerning BAD were made by TGR, so it would appear that "the boys at BAD" did 
not do THEIR homework! 


"Rambone obviously does not get much exposure to the pirate world." Yet 
another ridiculous and unsubstantiated remark.. You boys definitly did not do 
your homework, you better start asking around a little more before making 
irresponsable accusations. The last words I will say about this is when 
people put a magazine together, they should try and find writers who will 
investigate facts instead of fabricating them. If they actually read my 
article, they would have known that I did not say a word about their magazine, 
but rather quoted The Grim Reaper. With writers such as those at BAD, I would 
not suggest anyone waste their time reading it, unless you are into tabloids 
like National Inquirer, but then at least some of their articles have a basis 
in fact. 


Game Of The Month : Links 386 Pro 


-*— Release Information -—*- : -*—- Game Information -*- 
Cracker None : Publisher MICROPLAY 
Protection Type None : Graphics SVGA Minimum 
Supplier The Witch King : Sound All 
Date of Release 07/13/92 : Rating [1-10] 10 


Sorry guys for reprinting the information file, but I got lazy <g>. 


With the advent of the Super VGA Monitors, and the prices becoming more 
resonable, companies are starting to come out with special games to take 
advantage of SVGA mode. Most of these games still will play in VGA mode so 
don’t fret. 


One of the latest to date, and probably the best is Links 386 Pro, which the 


title indicates, at least a 386 is required. The installation of the game is 
one of the most impressive I hav ver seen, they cover every aspect of your 
hardware to take full advantage of it. One of the harder things to swallow is 


that you must have at least 512k of memory on your VGA card, and it must comply 
by the VESA standard. If it does, the instalation is smart enough to try and 
find one for you. 


The game it’s self is a major improvement over it’s predecessor, Links. The 
graphics are much improved, which was a feat in itself, and many more options 
a 
a 


nd bugs had been taken care of. The company also listened to its customers 
nd added many new features that were suggested. 


When first loading up 386 pro, you are greated by a backview of a course 
instead of the boring blank screen in the original. From there, you can just 
about set up anything under the moon, from your club selection, to fairway 
conditions, and techture of the greens. You can even select the wind 
conditions. One of the most impressive features besides the outstanding 
grahpics is the option to have multiple windows open while playing the game. 


Let’s say you are at the first hole, about to drive one down the fairway, if 
you can make it there, you can also have another window up overlooking the 
fairway waiting to see where the ball is going to drop. This is just one of 
many windows you can open, four at the most. After playing it for quite 
sometime, I would only suggest one or two though. 


If you are contiplating buying a game to take advantage of your SVGA monitor, 
look no further than Links 386 Pro. It’s the wave of the future, and it’s here 
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now. 


No Longer Buy Console, Copy Them 


Special Thanks Snow Dog 


The following is an information excerpt on the GameDoctor. Basically, you can 
buy a machine called the GameDoctor hook it up to your PC and copy the rom data 
over to your HD in a compresed format. From there, you can send it over the 
nets, through the modem, or bring it to a friend’s house. You hook the 
GameDoctor up to your PC, hook your console game to the GameDoctor and transfer 
the compressed data file onto a blank cartridge. Wow, instant Super Mario 
brothers. There will be a more in-depth review of this machine in the next 
issue, for now, here’s a little taste. 


Snow Dog writes: 


The machines are external SCSI interface machines, about the size of a super 
NES but wider, and fitted for japanese (super famicom) cartridges. They are 
made by electronics nippon, known as NEC in the States, and friend has one 

that works on both his Amiga 2000 and his 486-33 (SCSI is universal). 


They include five disks of Famicom OS, which you can use on a logical harddisk 
partition of around six megs since SNES games are measured in MegaBITS and will 
NEVER get bigger than four meg or so, but the OS needs room. Controllers et. 
al. plug into the copier units. 


If you take an SNES or Genesis cart out of their shell and put it in a SF 
shell, you can copy them too. It works like teledisk, and Altered Reality in 
(303) 443-1524 has console game file support. All you do is download it and use 
your own console copier to put it on a cart, or at your option if it is a SNES 
or Famico game, play it off your OS. Genesis games don’t work in the SF OS so 
you need to copy them to cartridge. 


There are Japanese copiers specifically for Mega Drive (Genesis) that will do 
the same except that the OS is Sega-specific and you’1ll eed to copy SNES games. 
There is also a NEC PC Engine (turbo graphics and super graphics) copier 
because they made the bloody system, but it is proprietary and it will only 
work with the turbo format. 


I have never seen or worked with an internal model, but there is an internal 
5.25" full height model in the NEC catalog...I ordered the catalog after I saw 
an advertisement for it in the back of Electronic Gaming Monthly, and a rather 
rich friend of mine went and bought the system. He also bought the $130 
Japanese Street fighter II and copied it for all of us. How nice of him! Of 
course we had to buy the cartridges and pay him $20, but he made a $100 profit. 
Good deal for him! 


Okay, that is it for now. Greets go out to Cool Hand, Ford Perfect, Lestat, 
RifleMan, The CrackSmith, AfterMath, both Night Rangers, Kim Clancy, Bar 
Manager, Butcher, Venom, and all the couriers who help make things happen. 


Special thanks to Tempus for one kick ass ansi! 


Until next time, keep playing. 
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In Phrack 38, I discussed the history of cellular telephony, monitoring 
techniques, and a brief description of its predecessors. In Part II, I’1l 
describe the call processing sequences for land-originated and mobile- 
originated calls, as well as the signaling formats for these processes. I 
apologize for the bulk of information, but I feel it is important for anyone 
who is interested in how the network communicates. Please realize that there 
was very little I could add to such a cut and dried topic, and that most is 


taken verbatim from Industry standards, with comments and addendum salt and 
peppered throughout. 


Call-Processing Sequences 


Call-Processing Sequence for Land-Originated Calls 


MTSO Cell Site Mobile Unit 
1 -- Transmits setup channel data on paging channel 
2 Scans and locks on 


paging channel 
Receives incoming call --- 3 
and performs translations 


Sends paging message ----- 4 
to cell site 
5 -- Reformats paging 
message 
6 -- Sends paging message 


to mobile unit via 
paging channel 
7 Detects Page 


8 Scans and locks on 
access channel 
9 Seizes setup channel 
10 Acquires sync 
alee Sends service request 
12 -- Reformats service request 
13 -- Performs directional locate 
14 Sends service request to MTSO 
Selects voice channel --- 15 
Sends tx-on command to -- 16 
cell site 
17 -- Reformats channel designation message 
18 -- Sends channel designation message to mobile 
unit via access channel 
19 Tunes to voice 


channel 
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20 Transponds SAT 
21 -- Detects SAT 
22 -- Puts on-hook on trunk 
Detects off-hook 23 
Sends alert order ------- 24 
25 -—- Reformats alert order 
26 -—- Sends alert order to mobile unit via blank- 
and-burst on voice channel 
27 Alerts User 
28 Sends 10-kHz tone 
29 -—- Detects 10-kHz tone 
30 -- Puts on-hook on trunk 
Detects on-hook 31 
Provides audible ring --- 32 
33 -- Detects absence of 10-kHz tone 
34 -- Puts off-hook on trunk 
Detects off—-hook 35 
Removes audible ring ---- 36 
and completes connection 
Time 


Call-Processing Sequence for Mobile-Originated Calls 


MTSO Cell Site Mobile Unit 
1 -- Transmits setup channel 
data on paging channel 
2 Scans and locks-on 
paging channel 
S) User initiates call 
4 Scans and locks-on 
access channel 


5 Seizes setup channel 
6 Acquires sync 
7 Sends service request 
8 -- Reformats service request 
9 -- Performs directional Locate 
10 Sends service request to MTSO 
Selects voice channel ---- 11 
Sends tx-on command to --- 12 
cell site 
13 -- Reformats channel designation message 
14 -- Sends channel designation message to mobile 
unit via access channel 
15 Tunes to voice 
channel 
16 Transponds SAT 
17 -- Detects SAT 
18 -- Puts off-hook on trunk 
Detects off-hook 19 
Completes call through --- 20 


network Time 


Let me review the frequency allocation for Wireline and non-Wireline systems. 
Remember that the Wireline service is usually provided by the area’s telephon 
company, in my area that company is NYNEX. The non-Wireline companies are 
usually operated by other carriers foreign to the area, in my area we are 
serviced by Cellular One (which is owned by Southwestern Bell). Each company 
has its one slice of th lectro-magnetic spectrum. The coverage is not 
continuous, remember that there are also 800 MHz trunked business systems that 
also operate in this bandwidth. Voice channels are 30 KHz apart and the Data 
channels are 10 KHz apart. 


Frequency Range Use 
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870.000 -— 879.360 Cellular One 

880.650 - 890.000 NYNEX (mobi 

890.000 -— 891.500 Cellular One 

891.500 -— 894.000 NYNEX (mobi 

879.390 - 879.990 Cellular One (data) 

880.020 -— 880.620 NYNEX (data) 

The data streams are encoded NRZ 

are now zero-to-one and one-to-zero transitions respectively. 
wideband data can modulate the tra 


and ones and zeroes into the modulator MUST 
8 KHz above and bel 


frequency deviations of 


PUTTING IT ALL 


3 


(mobile input 825.000 —- 834.360) 
le input 835.650 - 845.500) 
(mobile input 845.000 -— 846.500) 
le input 846.500 - 849.000) 


he following information will 


be 


invaluab] 


ellular telephones via a scanne 
nformation released below is 


he call processing and digital 


ar phones, 


r and can 


but al 


(Non-return-to-zero) 


binary ones and zeroes 
This is so the 


nsmitter via binary frequency shift keying, 


now be equivalent to nominal peak 


access control channel 
EIA/TIA -- FCC standard. 
ll phones must interface into the 
obile network and talk fluently between each other and cell sites. 


low the carrier frequency. 


TOGETHER -— Signaling on the Control Channels 


e to the hobbyist that is monitoring 


signals. All 


There are a lot of 


Therefore, 


signaling techniques are uniform throughout the 


T 
G 
i 
differences between cellul 
m 
ic 
industry. 


MOBILE 


CALL PROCESSING 


Calling: 


Initially, 
monitoring some control 
ESN request, then mobil 


channel, 


e registration, 


When registration is set to one, 
during system access, another 
control-filler (RCF) should be 


set to l, 


the land station transmits the first part of its SID to a mobile 
followed by the number of paging channels, 
which will either be set to 0 or 1. 


an 


the mobile will transmit both MINI and MIN2 


for discontinuous 
and access functions 


paging operations) require fi 
access) goes to 0. 


Receiving: 


As the mobile enters the Scan Dedicated Control Channels Task, 


d control 


Signal strengths of each dedicat 
enabled. 


in the NAWC 


been received. An EDN 
messages are not to be 
code be received along 
part of the NAWC count 
instructions. 


Under normal circumstances, 
control channel, 
seconds, set up the following: 


ld setting to l, 


Otherwise System B control channels ar 


(DTX) transmissions, read 
(if combined with 


otherwise CPA (combined paging 


it must examine 


channel assigned to System A if 


le 


(Number of Additional Words Coming) 


message train will determine for the mobi if all 


checked. The values assigned 
system parameter overhead 
intended information has 


field is used as a crosscheck, 

counted as part of the message. 
with a non-recognizabl 
train but the equivalent should not try and execute the 


receive a system parameter transmission, 


and control-filler 
Should a correct BCH 
it must be 


overhead message, 


mobiles are to tune to the strongest dedicated 


and, within 3 


o Set SID’s 14 most significant bits to SID1 field value. 


o Set SID’s least significant bit to 1, 
or to zero if not. 


enables, 


o Set paging channels N to 1 plus th 


if serving system status 


value of N-1 field. 


o Set paging channel FIRSTCHP as follows: 
hen FIRSTCHPs 


If SIDs = SIDp t 
paging channel). 
If SIDs = 


If SIDs = 


SIDp and serving system is 
initial dedicated channel 
SIDp and serving system is disabled, 


FIRSTCHPp (which is an 11-bit 


set FIRSTCHPs to 


nabled, 


1 for system B. 


set FIRSTCHPs to 
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first dedicated control channel for system B. 


o Set LASTCHPs to value of FIRSTCHPs + Ns -l. 


o Should the mobile com quipped for autonomous registration, it 
must: 


o Set registration increment (REGINCRs) to its 450 default 
value. 


o Set registration ID status to enabled. 


I know that was a little arcane sounding but it’s the best you can do with 
specifications. Data is data, there is no way to spruce it up. From here on 
out a mobile must begin the Paging Channel Selection Task. If this cannot be 
completed on the strongest dedicated channel, the second strongest dedicated 
channel may be accessed and the three second interval commenced again. 
Incomplete results should result in a serving system status check and an 
enabled or disabled state reversed, permitting the mobile to begin the Scan. 
Dedicated control Channels Task when channel signal strengths are once more 
examined. 


Custom local operations for mobiles may be sent and include roaming mobiles 
whose home systems are group members. A new access channel may be transmitted 
with a new access field set to the initial access channel. Autonomously 
registered mobiles may increment their next registered ID by some fixed value, 
but the global action message must have its REGINCR field adequately set. 

Also, so that all mobiles will enter the Initialization Task and scan dedicated 
control channels, a RESCAN global action message must be transmitted. 


Mobile stations may be required to read a control-filler message befor 
accessing any system on a reverse control channel. 


System access for mobiles is sent on a forward control channel in the following 
manner. Digital Color Code (DCC) identifies the land is carried with the 
system parameter overhead message overload class fields are set to zero among 
the restricted number, and the remainder set to 1. Busy-to-idle status (BIS) 
access parameters go to zero when mobiles are prevented from checking on the 
reverse control channel and the message must be added to the overhead. When 
mobiles can’t use the reverse control channel for seizure messages attempts or 
busy signals, access attempt parameters must also be included in the overhead. 
And when a land station receives a seizure precursor matching its digital color 
code with 1 or no bit errors, busy idle bits signals on the forward control 
channel must be set to busy within 1.2 milliseconds from the time of the last 
bit seizure. Busy-idle bit then must remain busy until a minimum of 30 msec 
following the final bit of the last word of the message has been received, or a 
total of 175 msec has elapsed. 


Channel Confirmation 


Mobiles are to monitor station control messages for orders and respond to both 
audio and local control orders even though land stations are not required to 
reply. MIN bits must be matched. Thereafter, the System Access Task is 
entered with a page response, as above, and an access timer started. 


This time runs as follows: 


o 12 seconds for an origination 
o 6 seconds for page response 

o 6 seconds for an order response 
o 6 seconds for a registration 


The last try code is then set to zero, and th quipment begins the Scan Access 
Channels Task to find two channels with the strongest signals which it tunes 
and enters the Retrieve Access Attempts Parameters Task. 


This is where both maximum numbers of seizure attempts and busy signals are 
each set to 10. A read control-filler bit (RCF) will then be checked: If the 
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RCF equals zero, the mobile then reads a control-filler message, sets DCC and 
WFOM (wait for overhead message train before reverse control channel access) to 
the proper fields and sets the proper fields and sets the appropriate power 
level. Should neither the DCC field nor the control-filler message be received 
and access time has expired, the mobile station goes to Serving System 
Determination Task. But within the allowed access time, the mobile station 
nters the Alternate Access Channel Task. BIS is then set to 1 and the WFOM 
bit is checked. If WFOM equals 1, the station enters the Update Overhead 
Information Task; if WFOM equals 0, a random delay wait is required of 0 to 200 


msec, +/- 1 msec. Then, the station enters the Seize Reverse Control Channel 
Task. 
Service Requesting is next. This task requires that the mobile continue to 


send is message to the land station according to the following instructions: 


o Word A is required at all times. 
o Word B has to be sent if last try access LT equals 1 or if E requires 
MIN1 and/or MIN2, and the ROAM status is disabled, or if the station 
has been paged with a 2-word control message. 

o Word C is transmitted with S (serial number) being 1 

o Word D required if the access is an origination 

o Word E transmitted when the access is an origination and between 9 
and 16 digits are dialed. When the mobile has transmitted its 
complete message, an unmodulated carrier is required for another 25 
milliseconds before carrier turnoff. After words A through E have 
been sent, the next mobile task depends on the type of access. 


Order confirmation requires entry into the Serving System Determination Task. 


Origination means entry into the Await Message Task. 
Page response, is the same as Origination. 


Registration requires Await Registration Confirmation, which must be completed 
within 5 seconds or registration failure follows. The same is true for Await 
Message since an incomplete task in 5 seconds sends the mobile into the Serving 
System Determination Task. Origination or Page response requires mobile update 
of parameters delivered in the message. If R equals 1, the mobile enters the 
Autonomous Registration Task, otherwise, it goes to the Initial Voice Channel 
Confirmation Task. Origination access may be either an intercept or reorder, 
and in these instances, mobiles enter the Serving System Determination Task. 
The same holds true for a page response access. But if access is an 
origination and the user terminates his call during this task, the call has to 
be released on a voice channel and not control channel. 


If a mobile station is equipped for Directed Retry and if a new message is 
received before all four words of the directed retry message, it must go to the 
Serving System Determination Task. There the last try code (LT) must be set 
according to the ORDQ (order qualifier) field of the message as follows: 


If 000, LT sets to 0 
If 0001, LT sets to 1 


Thereafter, the mobile clears the list of control channels to be scanned in 
processing Directed Retry (CCLIST) and looks at each CHANPOS (channel position) 
field contained in message words three and four. For nonzero CHANPOS field, 
the mobile calculates a corresponding channel number by adding CHANPOS to 
FIRSTCHA minus one. Afterwards, the mobile has then to determine if each 
channel number is within the set designated for cellular systems. A true 
answer requires adding this/these channel(s) to the CCLIST. 


Awaiting Answers 


Here, an alert timer is set for 65 seconds (0 to +20 percent). During this 
period the following events may take place: 


o Should tim xpire, the mobile turns its transmitter off and enters 
the Serving System Determination Task. 
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o An answer requires signaling tone turnoff and Conversation Task 
entry. 

o If any of the messages listed hereafter are received within 100 
milliseconds, the mobile must compare SCC digits that identify stored 
and proper SAT frequencies for the station to the PSCC (present SAT 
color code). If not equivalent, the order is ignored. If correct, 
then the following actions taken for each order: 

Handoff: Signaling extinguished for 500 msec, signal tone off, 

transmitter off, power lever adjusted, new channel tuned, new SAT, new 

scc field, transmitter on, fade timer reset, and signaling tone on. 

Wait for an answer. 

Alert: Reset alert timer for 65 seconds and stay in 
Waiting for Answer Task. 
Stop Alert: Extinguish signaling tone and enter Waiting for Order Task. 

Release: Signaling tone off, wait 500 msec, then enter Release Task. 
Audit: Confirm message to land station, then stay in 

Waiting for Answer Task. 
Maintenance: Reset alert timer for 65 seconds and remain in 

Waiting for Answer Task. 

Change Power: Adjust transmitter to power level required and send 
confirmation to land station. Remain in 
Waiting for Answer Task. 

Local Control: If local control is enabled and order received, examine LC 
field and determine action. 
Orders other than the above for this type of action are 
ignored. 

Conversation 

In this mode, a release-delay timer is set for 500 mSec. If Termination is 
enabled, the mobile sets termination status to disabled and waits 500 mSec 
before entering Release Task. The following actions may then execute: 


o Upon call termination, the release delay timer has to be checked. 
If time has expired, the Release Task is entered; if not expired, 
the mobile must wait until expiration and then enter Release Task. 


o Upon user requested flash, signaling tone turned on for 400 mSec. 
But should a valid order tone be received during this interval, 
the flash is immediately terminated and the order processed. The 
flash, of course, is not then valid. 


o Upon receipt of the following listed orders and within 100 mSec, 
the mobile must compare SCC with PSCC, and the order is ignored 
if the two are not equal. But if they are the same, the following 
can occur: 


Handoff: Signaling tone on for 50 mSec, then off, transmitter off, 
power level adjusted, new channel tuned, adjust new SAT, set SCC to SCC 
field message value, transmitter on, fade timer reset, remain in 
Conversation Task. 


Send Called Address: Upon receipt within 10 seconds of last valid flash, 


called address sent to land station. Mobile remains in 
Conversation Task. Otherwise, remain in Conversation Task. 


Alert: Turn on signaling tone, wait 500 mSec, then enter 
Waiting for Answer Task. 
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Release: Check release delay timer. If time expired, mobile enters 
Release Task; but if timer has not finished, then mobile must 
wait and then enter Release Task when time has expired. 


Audit: Order confirmation sent to land station while remaining in 
Conversation Task. 


Maintenance: Signaling tone on, wait 500 mSec, then enter Waiting for 
Answer Task. 


Change Power: Adjust transmitter to power level required by order 
qualification code and send confirmation to land station. 
Remain in Conversation Task. 


Local Control: If local control in enabled and local control order received, 
the LC field is to be checked for subsequent action and 
confirmation. 


Orders other than the above for this type of action are ignored. 


Release 


In the release mode the following steps are required: 


o Signaling tone sent for 1.8 sec. If flash in transmission when 
Signaling tone begun, it must be continued and timing bridged so 
that action stops within 1.8 sec. 

o Stop signaling tone. 


fe) Turn off transmitter. 


o The mobile station then enters the Serving System 


Determination Task. 
The above is the Cellular System Mobile/Land Station Compatibility 
Specification. The following shall be Signaling Formats which are also found 
in the above document. I converted all these tables by HAND into ASCII so 


appreciate them. It wasn’t the easiest thing to do. But I must say, I 
definitely understand the entire cellular operation format. 


There are two types of continuous wideband data stream transmissions. One 
is the Forward Control Channel which is sent from the land station to the 
mobile. The other is the Reverse Control Channel, which is sent from the 
mobile to the land station. Each data stream runs at a rate of 10 kilobit/sec, 
+/- 1 bit/sec rate. The formats for each of the channels follow. 


— Forward Control Channel 


a 


The forward control channel consists of three discrete information streams. 
They are called stream A, stream B and the busy-idle stream. All three streams 
are multiplexed together. Messages to mobile stations with the least 
Significant bit of their MIN number equal to "0" are sent on stream A, and 
those with a "1" are sent on stream B. 


The busy-idle stream contains busy-idle bits, which are used to indicate the 
status of the reverse control channel. If the busy-idle bit = "0" the reverse 
control channel is busy, if it equals "1" it is idle. The busy-idle bit is 
located at the beginning of each dotting sequence, word sync sequence, at the 
beginning of the first repeat of word A and after every 10 message bits 
thereafter. 


Mobile stations achieve synchronization with the incoming data via a 10 bit 
dotting sequence (1010101010) and an 11 bit word sync sequence (11100010010). 
Each word contains 40 bits, including parity and is repeated 5 times after 
which it is then referred to as a "block". For a multiword message, the second 
word block and subsequent word blocks are formed the same as the first word 
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block including the dotting and sync sequences. A "word" is formed when the 28 
content bits are encoded into a (40, 28; 5) BCH (Bose-Chaudhuri-Hocquenghem) 
code. The left-most bit shall be designated the most-significant bit. 


The Generator polynominal for the (40, 28;5) BCH code is: 


Each FOCC message can consist of one or more words. Messaging transmitted over 
the forward control channel are: 


- Mobile station control message 
Overhead messag 
— Control-filler messag 


Control-filler messages may be inserted between messages and between word 
blocks of a multiword message. 


Message Formats: Found on either stream A or B 
- Mobile Station Control Message 
The mobile station control message can consist of one, two, or four words. 


Word 1 (abbreviated address word) 


T t 
1 2 DCC Mobile Identification Number 1 P 
23-0 
bits: 2 2 24 12 
Word 2 (Extended Address Word) 
T T |SCC = RSVD LOCAL CRDQ ORDER 
ds” Qs), al MIN2 = 0 
3-24 P 
10 SCC = VMAC CHAN 
11 
2 2 10 3 11 12 
Word 3 (First Directed-Retry Word) 
T T SCC RSVD 
T 32 = CHANPOS CHANPOS CHANPOS = 
= 000 P 
10 11 
2 2 7 7 7 3 LD 
Word 4 (Second Directed-Retry Word) 
[rv OE |. SSCCs | | | | RSVD | | 
| Tt 25] = | CHANPOS | CHANPOS | CHANPOS | = | | 
| = i | | | | 000 | P | 
| 10 | 11 =| | | | | | 
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on of the data fields: 


Type field. If only Word 1 is send, set to 00 in Word 1. 
SAT color code (discussed previously) 

Order field. Identifies the order type (s table below) 
Order qualifier field. Qualifies the order to a specific 
action 

Local control field. This field is specific to each system. 


VMAC 


CHAN = 


CHANPOS-— 


RSVD = 
Pp _ 


The ORDER field must be set to local control for this field to 
be interpreted. 

Voice Mobile Attenuation Code field. Indicates the mobile 
station power level associated with the designated voice 
channel. 
Channel number field. Indicates the designated voice channel. 
CHANnel POSition field. Indicates the position of a control 
channel relative to the first access channel (FIRSTCHA). 
Reserved for future use, all bits must be set as indicated. 
Parity field. 


Coded Digital Color Code 


Received 
00 
01 
10 
11 


DCC 7-bit Coded DCC 
0000000 
0011111 
1100011 
1111100 


Order and Order Qualification Codes 


Order Order | 
Code Qualification | Function 
Code | 
00000 000 page (or origination) 
00001 000 alert 
00011 000 release 
00100 000 reorder 
00110 000 stop alert 
00111 000 audit 
01000 000 send called-address 
01001 000 intercept 
01010 000 maintenance 
010 000 charge power to power level 0 
010 001 charge power to power level 1 
010 010 charge power to power level 2 
010 O11 charge power to power level 3 
010 100 charge power to power level 4 
010 101 charge power to power level 5 
010 110 charge power to power level 6 
010 aL DAL charge power to power level 7 
01100 000 directed retry not last try 
01100 001 directed retry last try 
01101 000 non-autonomous registration - don’t reveal location 
01101 O01 non-autonomous registration —- make location known 
01101 010 autonomous registration - don’t reveal location 
01101 O11 autonomous registration - make location known 
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000 


local control 


reserved 


10 


| 
| 
| All other codes ar 
| 


Forward Voice Channel 


(FVC) 


station to the mobile station. 


is a wideband data stream sent by the 


land 


This data stream must be generated at a 10 


kilobit/Sec +/- .1 bit/Sec rat The Forward Voice Channel format follows: 
| Repeat Repeat 
| word word word 
| Dotting sync 1 of dot sync 2 OF dot sync 
| 
| Word Word 
101 11 40 37 11 40 37 11 
Repeat Repeat Repeat | | 
word word | 
9 of dot sync 10 of dot sync 11 of | 
| 
Word Word Word | 
40 37 11 40 37 11 40 
A 37-bit dotting sequence and an 11-bit word sync sequence are sent to permit 


mobile stations to achieve synchronization with the incoming data, 
the first repeat of the word, where the 101-bit dotting sequence is used. Each 
word contains 40 bits, including parity, and is repeated eleven times together 
with the 37-bit dotting and 11-bit word sync; it is then referred to as a word 
block. A word block is formed by encoded the 28 content bits into a (40, 28) 
BCH code that has a distance of 5 (40, 28; 5). The left-most bit (as always) 
is designated the most-significant bit. The 28 most significant bits of the 
40-bit field shall be the content bits. The generator polynominal is the same 
as that used for the forward control channel. 


except at 


The mobile station control message is the only message transmitted over the 
forward voice channel. The mobile station control message consists of one 
word. 


Mobile Station Control Message: 
Tr wt SCC = RSVD = LOCAL ORDQ ORDER 
i: 72 14. 000 0 
= Poa PSCC 124 
SCC = RSVD = VMAC CHANNEL 
10 11 000 0 
2 2 2 8 > aa 12 


Interpretation of the data fields: 


ce ek - Type field. Set to ’10’. 
Lo? 
SCC - SAT color code for new channel (see SCC table) 
PSCC - Present SAT color code. Indicates the SAT color code 
associated with the present channel. 
ORDER - Order field. Identifies the order typ (s Order table) 
ORDO —- Order qualifier field. Qualifies the order to a specific 
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action (see Order table) 


LOCAL —- Local Control field. This field is specific to each system. 
The ORDER field must be set to local control (see Order table) 
for this field to be interpreted. 

VMAC -— Voice mobile attenuation code field. Indicates the mobile 
station power level associated with the designated voice 
channel. 

RSVD —- Reserved for future use; all bits must be set as indicated. 

P - Parity field. 


Reverse Control Channel 


The Reverse Control Channel (RECC) is a wideband data stream sent from the 
mobile station to the land station. This data stream runs at a rate of 10 
kilobit/sec, +/- 1 bit/sec rate. The format of the RECC data stream follows: 


Dotting Word Coded first word Second word Third word 


sync DCC repeated repeated repeated 
5 times 5 times 5 times 
bits: 30 11 7 240 240 240 


Dotting = 01010101...010101 


Word sync 11100010010 


All messages begin with the RECC seizure precursor with is composed of a 30 bit 
dotting sequence (1010...101), and 11 bit word sync sequence (11100010010), and 
the coded digital color code. 


Each word contains 48 bits, including parity, and is repeated five times after 
which it is referred to as a word block. A word is formed by encoding 36 
content bits into a (48, 36) BCH code that has a distance of 5, (48 36; 5). 
The left most bit shall be designated the most-significant bit. The 36 most 
Significant bits of the 48 bit field shall be the content bits. 


he generator polynomial for the code is the same for the (40,28;5) code used 
on the forward channel. 


Each Reverse Control Channel message can consist of one of the five words. The 
types of messages to be transmitted over the reverse control channel are as 
follows: 


Page Response Messag 
Origination Message 

Order Confirmation Message 
Order Message 


oO0O0°0 


These messages are made up of combination of the following five words: 


Word A - Abbreviated Address Word 


F RSVD iS) 


= NAWC T Ss 


ea 
ll 
Q 
< 
= 
Z 
tu 


Word B — Extended Address Word 
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| F | | | | | | RSVD | | | 
| | | | | | | | | 
| = | NAWC | LOCAL | ORDQ | LOCAL | LT | = | MIN 2 | P | 
| | | | | | | | 33-24 | | 
| O | | | | | | 0O..0| | | 
1 3 3) 3 b) 1 8 10 12 
Word C - Electronic Serial Number Word 
F 
= NAWC SERIAL (ESN) P 
1 
1 3 32 12 
Word D - First Word of the Called-Address 
F lst 2nd 7th 8th 
= NAWC DIGIT DIGIT DIGIT DIGIT P 
iL, 
1 3 4 4 4 4 4 4 4 4 12 
Word E — Second Word of the Called-Address 
F NAWC 9th 10th 15th 16th 
= = DIGIT DIGIT DIGIT DIGIT P 
0 000 
1 3 4 4 4 4 4 4 4 4 12 


The interpretation of the data fields is as follows: 


NAWC 


First word indication field. Set to ’1’ in first word and ’0’ 
in subsequent words. 


Number of additional words coming field. 

T field. Set to ’1’ to identify the message as an origination 
or an order; set to ’0’ to identify the message as an order 
response or page response. 

Send serial number word. If the serial number word is sent, 
set “to “1; if the serial number word is not sent, set to 
Or: 

The station class mark field 

Order field. Identifies the order typ 

Order qualifier field. Qualifies the order confirmation to a 
specific action. 

.ocal control field. This field is specific to each system. 


The ORDER field must be set to locate control for this field 
to be interpreted. 
Last-try code field. 

Mobile Identification number field part one. 

Mobile Identification number field part two. 

Electronic Serial Number field. Identifies the serial number 
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of the mobile station. 


DIGIT - Digit field (s table below) 
RSVD —- Reserved for future use; all bits must be set as indicated. 
P - Parity field. 


Called-address Digit Codes 


Digit Code Digit Code 
1 0001 7 0111 
2 0010 8 1000 
3 0011 9 1001 
4 0100 0 1010 
5 0101 ig 1011 
6 0110 1100 
Null 0000 
NOTE: 
1. The digit 0 is encoded as binary 10, not binary zero. 
2. The code 0000 is the null code, indicated no digit present 
3. All other four-bit sequences are reserved, and must not be 
transmitted. 
Examples of encoding called-address information into the called address words 
follow: 


If the number 2# is entered, the word is as follows: 


NOTE 0010 1100 0000 0000 0000 0000 0000 0000 P 


If the number 13792640 is entered, the word is as follows: 


NOTE 0001 0011 0111 1001 0010 0110 0100 1010 P 


As you can s the numbers are coded into four bits and inserted sequentially 
into the train. Notice that when the number is longer than 8 numbers it is 
broken into two different Words. 


If the number 6178680300 is entered, the words are as follows: 


Word D - First Word of the Called-Address 


NOTE 0110 0001 0111 1000 0110 1000 1010 1010 P 


Word E — Second Word of the Called-Address 


NOTE 0010 1010 1010 0000 0000 0000 0000 0000 P 


NOTE = four bits which depend on the type of messag 


Reverse Voice Channel 


The reverse voice channel (RVC) is a wideband data stream sent from the mobile 
station to the land station. This data stream must be generated at a 10 
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kilobit/second +/- 1 bit/sec rat The format is presented below. 
| Repeat 1 Repeat 2 
| word word word 
| Dotting sync of Dot sync of Dot sync 
| 
| Word 1 Word 1 
101 11 48 37, 11 48 37 11 
Repeat 3 Repeat 4 Repeat 5 
word word 
of Dot sync of Dot sync of Dot 
Word 1 Word 1 Word 1 
48 37 11 48 37 1 48 37 
Repeat 1 Repeat 5 | | 
word | 
sync of of | 
| 
Word 2 Word 2 | 
A 37-bit dotting sequence and an 11-bit word sync sequence are sent to permit 


land stations to achieve synchronization with the incoming data, 


first repeat of word 1 
cluding parity, 


contains 48 bits, 


the 37-bit dotting and 11-bit word sync sequences; 


word block. For a multi-word 


in 


, where a 101-bit dotting sequence is used. 


except at the 
Each word 


and is repeated fiv 


message, 


th 


times together with 
it is then referred to as a 
second word block is formed the same 


as the first word block including the 37-bit dotting and 11-bit word sync 


sequences. 
BCH code that has a distance of 5, 


time) shall be designated the most-significant bit. 


bits of the 48-bit field shall 


for the code is the same as for the 


control channel. 


transmitted over th 


voic 


(48, 


36; 5). 


The 


A word is formed by encoding the 36 content bits into a 
left-most bit 
The 36 most-significant 


(48, 36) 


be the content bits. The generator polynomial 
code used on the forward 


(40, 


revers 


o Order Confirmation Message 
o Called-Address Messag 


The message formats are as follows: 


Order Confirmation Message: 


28; 5) 


Each RVC message can consist of one or two words. 
channel are as follows: 


The types of messages to be 


F NAWC T RSVD 

= = 4 LOCAL ORDQ ORDER = Ep 
1 00 1 000 0 

1 2 ‘Jl. 5 3 5 19 12 
Called-Address Messag 


Word 1 


- First Word of the Called-Address 


(earliest in 
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| F | NAWC | T | | | | | | | | | 
| | | | Ist | 2nd | | | | 7th | 8th | | 
| = | = | = | Digit | Digit | [44-08 /| | Digit | Digit | P | 
| | | | | | | | | | | | 
[ees ede te 0% G] | | | | | | | | 

1 2 dl. 4 4 4 4 4 4 4 4 12 

Word 2 — Second Word of the Called-Address 
F NAWC Tr 
9th 10th 15th 16th 

= = = Digit Digit Digit Digit P 

0 00 OD 

1 2 a 4 4 4 4 4 4 4 4 12 


The fields are descriptions a the me as those for the Reverse Control channel 
above. 


Overhead Messag 


A three-bit OHD field is used to identify the overhead message types. Overhead 
message type codes are listed in the table below. They are grouped into the 
following functional classes: 


o System parameter overhead messag 

o Global action overhead messag 

o Registration identification message 

o Control-filler messag 
Overhead messages are send in a group called an overhead message train. The 
first message of the train must be the system parameter overhead message. Th 
desired global action messages and/or a registration ID message must be 
appended to the end of the system parameter overhead message. The total number 


of words in an overhead message train is one more than the value of the NAWC 
field contained in the first word of the system parameter overhead messag 
The last word in the train must be set to ’0’. For NAWC-counting purposes, 
inserted control-filler messages must not be counted as part of the overhead 
message train. 


The system parameter overhead message must be sent every .8 +/- .3 seconds on 
each of the following control channels: 


o combined paging-access forward channel. 

o Separate paging forward control channel 

o Separated access forward control channel when the control-filler 
message is sent with the WFOM bit set to ’1’. 


The global action messages and the registration identification message are sent 
on an as needed basis. 


o The system parameter for overhead message consists of two words. 


0 Word 1 


= DCC SID1 = NAWC = P 
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Word 2 
T T RSVD 
i 2 
= DCC Ss EK REGH REGR DTX = 
11 0 
2 2 aI 1 1 1 1 1 
OHD 
N- 1 RCF CPA CMAX - 1 END = RB 
111 
5 1 1 7 1 3 12 
Overhead Message Types 
Code Order 
000 Registration ID 
O01 Control-filler 
010 reserved 
O11 reserved 
100 global action 
0 reserved 
110 Word 1 of system parameter message 
1 Word 2 of system parameter message 


The interpretation of the data fields: 


TT Type field. Set to ’11’ indicating an overhead word. 
L $2 

OHD Overhead message type field. The OHD field of Word 1 is set 
to ’110’ indicating the first word of the system parameter 
overhead message. The OHD field of Word 2 is set to ’111’ 
indicating the second word of the system parameter overhead 
message. 

DCC - Digital Color Code field. 

SID1 — First part of the system identification field 

NAWC —- Number of Additional Words Coming field. In Word 1 this 


field is set to one fewer than the total number of words in 
the overhead message train. 


S — Serial number field. 

E — Extended address field. 

REGH — Registration field for home stations. 

REGR —- Registration field for roaming stations. 

DTX —- Discontinuous transmission field. 

N-1 - N is the number of paging channels in the system. 

RCF — Read-control-filler field. 

CPA — Combined paging/access field 

CMAX-1 —-— CMAX is the number of access channels in the system. 

END - End indication field. Set to ’1’ to indicate the last word 

and ’0’ if not the last word. 

RSVD —- Reserved for future use, all bit must be set as indicated. 

P —- Parity field. 
Each global action overhead message consists of one word. Any number of global 
action messages can be appended to a system parameter overhead messag 
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Here are the global action command formats: 
Rescan Global Action Message 
Tt. aE ACT RSVD = OHD 
1 2 
= DCC = END = P 
000 ... 0 
Al. 0001 100 
2 2 4 16 1 3 12 
Registration Increment Global Action Message 
i ACT OHD 
1 2 RSVD = 
= DCC = REGINCR END = P 
0000 
11 0010 100 
2 2 4 12 4 1 3 12 
New Access Channel Set Global Action Message 
LUT ACT OHD 
1 2 RSVD = 
= DCC = NEWACC END = P 
00000 
11 0110 100 
2 2 4 Lz 5 1 3 12 
Overload Control Global Action Message 
TT ACT O ) O e) ) ) OHD 
1 2 L L L L L L 
= DCC = e C € om € C € END = P 
11 0110 0 1 2 13| 14| 15 100 
2 2 4 1 1 1 1 1 1 1 3. 12 
Access Type Parameters Global Action Message 
T. UE ACT OHD 
1 2 RSVD = 
= DCC = BIS END = P 
0 000 
Ja: 1001 100 
2 2 4 1 15 1 3 12 
Access Attempt Parameters Global Action Message 
[ree SEP (| | ACT | | | 
| Td «| | MAXBUSY | MAXSZTR | MAXBUSY | 
| = | bcc | = | | | 
| | | = <P.GR | — PGR | -— OTHER | 


6.txt 


The registration I 


T T 
1 2 


REGINCR 
NEWACC 

MAXBUSY 
— PGR 

MAXBUSY 
— OTHER 
MAXSZTR 
— PRG 


LOCAL 
CONTROL 


DP 


The interpretation of the data fields are 


as follows: 
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11 | | 1010 | 
2 4 4 4 4 
OHD 
MAXSZTR 
END = P 
- OTHER 
100 
1 3 12 
Local Control 1 Message 
T ACT OHD 
1 2 
oa DCC m= LOCAL CONTROL END = P 
11 1110 100 
2 4 16 1 3 12 
Local Control 2 Message 
a ACT OHD 
Ls 2 
a DCC = LOCAL CONTROL END = P 
11 1111 100 
2 4 16 1 3 12 


indicating the 


to indicate the last word 


Type field. Set to ’11’ indicating overhead word. 
Global action field (s table below). 

Busy-idle status field. 

Digital Color Code. 

Overhead Message type field. Set to ’100’ 
global action message. 

Registration increment field. 

News access channel starting point field. 
Maximum busy occurrences field (page response). 
Maximum busy occurrences field (other accesses) . 
Maximum seizure tries field (page response). 
Maximum seizure tries field (other accesses). 
Overload class field (N = 0 to 15) 

End indication field. Set to ’1’ 

of the overhead message train; set to ’0’ 


Reserved for future use, 


Parity field. 


if not last word. 


all bits must be set as indicated. 


May be set to any bit pattern. 


D message consists of one word. 


be appended to a system parameter overhead messag 
action messages. 


When sent, 


the message must 


in addition to any global 


indicating the 
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TT #E OHD 
1) 2 
= DCC REGID END = P 
11 000 
2 2 20 1 3 12 
The interpretation of the data fields: 
ie See -— Type field. Set to ’11’ indicating overhead word. 
DEC —- Digital color code field. 
OHD Overhead message type field. Set to ’000’ 
registration ID message. 
REGID — Registration ID field. 
END —- End indication field. Set to ’1’ to indicate last word of 
the overhead message train; set to. ¥.0" “tf net. 
P - Parity field. 


consists of one word. 


It is sent whenever ther 


is 


The control-filler messag 
no other message to b 
between messages 
control-filler message is chosen so that when it is sent, 
sequence will not appear in the message stream, 
bit status. 


sent on the forward control channel. 


The control-filler messag 


It may be inserted 


as well as between word blocks of a multiword message. 
the 11-bit word 
independent of the busy-idle 


is also used to specify a control mobile 


The 


attenuation code (CMAC) for use by mobile stations accessing the system on the 
reverse control channel, and a wait-—for-overhead-message bit (WFOM) indicating 
whether or not mobile stations must read an overhead message train before 
accessing the system. 
Lo Oe RVSD RVSD OHD 

1 2 

= Dcc |010111]| CMAC = 11 = 1 WFOM |1111 = P 

11 00 00 O01 

2 2 6 3 2 2 2 1 1 4 3 16 


Interpretation of the data fields: 


sii Y -— Type field. Set to ’11’ indicating overhead word. 
thea 2 

DCC —- Digital color code field. 

CMAC —- Control mobile attenuation field. Indicates the mobile 
station power level associated with the reverse control 
channel. 

RVSD —- Reserved for future use; all bits must be set as indicated. 

WEOM Wait-—for-overhead-message field. 

OHD Overhead message type field. Set to ’001’ indicating the 
control-filler word. 

P - Parity field. 


Data Restrictions 


Th 


11-bit sequence (11100010010) 


is shorter than the length of a word, 


and 


therefore can be embedded in a word. Normally, embedded word-syne will not 
cause a problem because the next word sent will not have the word-sync sequence 
embedded in it. There are, however, three cases in which the word-sync 


sequence may appear periodically in the FOCC stream. 


o th 


overhead messag 


They are as foll 


OWS: 
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o the control-filler messag 
o Mobile station control messages with pages to mobile stations with 
certain central office codes. 


These thr cases are handled by: 


1. Restricting the overhead message transmission rate to about once per 
second 

2. designing the control-filler message to exclude the word-sync 
sequence, taking into account the various busy-idle bits 

3. Restricting the use of certain office codes 


If the mobile station control message is examined with the MIN1 separated into 
NXX-X-XXX as described earlier (where NXX is the central office code, N 


represents a number from 2 - 9, and X represents a number from 0-9) the order 
and order qualifications table can be used to deduce when the word-synec word 
would be sent. If a number of mobile stations are paged consecutively with the 


same central office code, mobile stations that are attempting to synchronize to 
the data stream may not be able to do so because of the presence of the false 
word sync sequence. Therefore, the combinations of central office codes and 
groups of line numbers appearing in the following table must not be used for 
mobile stations. 


RESTRICTED CENTRAL OFFICE CODES 


Central 

ie we DCC NXX x XXX Office Thousands 

2 Code Digit 
0 000100(1) 0000 ed Hae 175 0 to 9 
0 000100(1) 0001 aor ae ies 176 0 to 9 
Ol 11 000100(1)0010 tie Jas 177 0 to 9 
Ol 12 000100(1)0011 gods ee 178 0 to 9 
0 000100 (1) 0100 ae or 179 0 to 9 
0 000100(1)0101 ite 3 wee 170 0 to 9 
Ol 11 000100(1)0110 Sid & Eecie 181 0 to 9 
Ol 11 000100(1)0111 Sts fed 182 0 to 9 
OZ 11 100010 (0) 1000 aks Sint 663 0 to 9 
OZ Ad. 100010(0)1001 sect tine 664 0 to 9 
OZ 11 100010(0) 1010 Sieve eee 665 0 to 9 
OZ 11 100010(0)1011 s2,2 sue 666 0 to 9 
OZ Z1 110001 (0) 0100 seeed aes 899 0 to 9 
OZ Z1 110001(0) 0101 aie toe 800 0 to 9 
OZ ZZ 000(1)0010 Pare wies 909 0 to 9 
00 ZZ 0 00(0)1001 OZ22Z shies 568 1 to 7 
00 ZZ 100(0)1001 OZ2ZZ vie 070 AL steG= 7 
00 ZZ 001110 (0) 0100 1022 sete 33:9 8,9,0 
00 ZZ 011110 (0) 0100 1022 Mies 595 8,9,0 
00 ZZ 01110(0) 0100 1022 See 851 8,9,0 
00 ZZ 111110(0) 0100 1022 sews 007 8,9,0 
OZ ZZ 000011(1)0100 0010 sente 150 2 
OZ ZZ 000111(1)0001 0010 224 2 
OZ ZZ 001011(1) 0001 0010 288 2 
OZ ZZ 001111(1) 0001 0010 352 2 
OZ ZZ 010011(1)0001 0010 416 2 
OZ ZZ 010111(1)0001 0010 470 2 
OZ ZZ 011011(1)0001 0010 544 2 
OZ ZZ 011111 (1)0001 0010 508 2 
OZ ZZ 100011(1)0001 0010 672 2 
OZ ZZ 100111(1)0001 0010 736 2 
OZ ZZ 101011(1)0001 0010 790 2 
OZ ZZ 101111(1) 0001 0010 864 2 
OZ ZZ 110011 (1) 0001 0010 928 2 
OZ ZZ 110111(1) 0001 0010 992 2 
OZ ZZ 111011(1) 0001 0010 056 2 
OZ ZZ 111111(1) 0001 0010 2 
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1. In each case, Z represents a bit that may be 1 or 0. 

Some codes are not used as central office codes in the US at this time. 
They are included for completeness. 

3. The bit in parentheses is the busy-idle bit. 


i) 


Well there is your signaling in a nutshell. Please note I hardly have the most 
up-to-date signalling data. Basically what was presented here was a skeleton, 
the bare bones without all the additions. There are some additions that are 
system specific. As I get updates I’1l be sure to share them with the rest of 
you. I would be interested in any feedback, so, if you have something to say, 
send it to: 


oblivion@atdt.org 


In the last article I said that there would be a listing of SID codes 
accompanying the article. Well, I forgot to edit that line out, but if you 
would like a copy of it, just mail me at the above address an you shall receive 
one. 


In the next article I will be going in-depth on the actual hardware behind the 
Mobile telephone, the chip sets, and its operation. I will also publish any 
updates to the previous material I find, as well as information on the 
transitory NAMPS system that will be used to bridge the existing AMPS cellular 
network over to the ISDN compatible fully digital network. 
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==Phrack Inc.== 


Volume Four, Issue Forty, File 7 of 14 
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= The Fine 


by Crimson Flash 


Art of Telephony = 


\V=\S\S\5\5\5\ 8) 5/=/=/=/=/=/=/ 


1! Bell! Bell! Your reign of tyranny is threatened, your secrets will 


be 


exposed. 


[The hackers have come to stake their claim and punch holes in your 


monopolistic control. The 1990s began with an attack on us, but will end with 
our victory of exposing the secret government and corruption that lies behind 
your walls and screens. Oppose us with all your might, with all your lies, 


wit 


one 


A. 
B. 
CG. 


I, 
2. 
3. 


ne) 


1. 
2s 


FPR QGOHDmaA YY 


h all your accountants and bogus 


, but you’ll never stop the many. 


Introduction 

Basic Switching 
RCMAC 

Office Equipment 


Function of RCMAC 


security "professionals." You can stop the 


How Does All This Fit Into RCMAC 


a. Coordination of Recent Change Source Documentation 
b. Processing of Recent Change Requests 
c. Administrative Responsibilities and Interface Groups 


The FACS Environment 


Getting Ready For Recent Change Message 


When MARCH Receives A Translation Packet (TP) 


MARCH Background Processing 
User Transaction in MARCH 
Service Order Forms 


When MARCH Receives A Service Order Image 


COSMOS Service Order From The SOI Command 


MSR — MARCH Status Report (MARCH) 
Other Notes 
Recommended Reading 


fas 
its 


lar 
pap 
DIS 
eve 


is 
inf 
Dif 


Introduction 


Bell. Bell Bell Bell! What is it about Bell? I am not sure what my 
cination is with them, but it never ceases nor does it ever diminish. Maybe 
because they are so private. Maybe its because they find it possible to 
rip millions of people off daily and they do it with such great ease. Or 
perhaps its just that they do not want anyone to know what they are doing. 


Around my area down here in Texas (512), the Central Office buildings have 
ge brick walls, cameras at each door, bright lights, and every piece of 
er says in big block letters: "PROPRIETARY INFORMATION -- NOT FOR USE OR 


CLOSURE OUTSIDE OF SOUTHWESTERN B 


ELL." This message can be found on 


rything, but their phone books! 


This files are about RCMAC and 


ormation yourself! One thing to 


Why? 


FACS/MARCH. The information presented here 


largely from memory. If you think the information is wrong, then get the 


keep in mind is that nothing is in stone! 


ferent BOCs (Bell Operating Companies) use different systems and have 


different ways of doing the same thing. Like in some areas RCMAC is the CIC, 


the 
Bel 


and promises. 


is 


done by your local BOC. 


MLAC may not exist, so on and so forth. So nothing is ever fully true with 
1, but then why should things like their systems differ from their policies 
There is a Bellcore standard and then there is the real way it 
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B. Basic Switching 
A switching system (a switch) allows connect between two (or more) phone 

lines, or two trunks. A basic Tl trunk is 24 lines on a 22 gauge, 4-wire 
twisted pair. Not only does it allow connect, it also controls connection, 
where you call, and when someone calls you. In short it controls everything 
about your phone! From a large AT&T 5ESS switching 150,000+ line to a small 24 
line PABX (Private Automatic Branch Exchange, a switch), they control your 
phone service. 


What’s the big deal about telephone switches? Telephony is the largest 
form of communications for just about everyone in the world! Just try life 
without a phone line to your house. I have four phone lines and sometimes that 
is still not enough. 


Today’s switches are digital. This means that when you talk on the phone, 
your voice is converted to ls and Os (on or off, true or false). This works in 
several steps: 


[0] You call someone. 
[1] Sampling -- The analog signal (your voice) is sampled at certain parts. 
The output is called Pulse Amplitude Modulation (PAM) signal. 


[2] Quantize -- The PAM signal is now measured for wave length high (or 
amplitude) where numbers are given to the signal. 

[3] Encoding -- In this step, the Quantized signal (with the numbers for the 
height of the wavelength (amplitude)) is converted to an 8-bit binary 
number. The output of the 8-bit "word" may be either a "1" (a pulse) or 
a "O" (no pulse). 

4] Encoding -- Produces a signal called a Pulse-Code Modulation (PCM) 


signal. PCM just means that the signal is modulating pulses (digital). 
From this point, the signal is switched to where it needs to go. 

5] The PCM signal is where it needs to go. The signal is now converted 
back to analog. 


6] Decoding -- The 8-bit PCM signal is sent to the decoder to get the 
number that measured the amplitude of the wave. 
7] Filtering -- This takes the PAM signal (the decoding produced) and it 


reproduces the analog signal just as it was. 


[1] [2] [3] [4] | S | [5] [6] [7] 
| w | 
| | | hi | — |) ie —_ | | | 
\/\/|Sampling|-|Quantize|-|Encode | | | tes, |] | | |Decoding|-|Filter|/\/ 
| || be | [tee] | | | 
| | | [debe | 
| PAM PCM PCM | 
Analog Signal (You Talking) if \ Analog Signal__| 
/ \ 
/ \ 
/ \ 
/ \ 
Blow Up / of the Switch \ 
i \ 
/ \ 
1 T T 1 1 T 1 
Sa ee eee ee T Sod ten es es i sa nacre: T a eee 
2 T T 2 S 2 2 
SSS T Tae ela oe mxn ==oSo T ae ea! 
fo) fo) 
——— ie) ie) —— 
m a T m n T n 
Pet as a, Tr SS Se Sata ee, Tr Lh ean, 
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The basic design of most of the switches today is a Time-Space-Time (TST) 
topology. In the Time-Space-Time in the arrangement shown, time slot 
interchangers will interchange information between external channels and 
internal (space array) channels. 


This is just a quick run through to gives you a general idea about 
switches without going into math and more technical ideas. For a better 
understanding, get "Fundamentals of Digital Switching" by John C. McDonald. 
This book is well written and describes ideas that I cannot get into. 


C. RCMAC 

The Recent Change Memory Administration Center’s (RCMAC) purpose is to 
make changes to the software in various Electronic Switching Systems (ESS). An 
ESS uses a Stored Program Control (SPC) to provide telephone service. Since 
people with phones and their services change often, the ESS uses a memory 
called Recent Change. This Recent Change area of memory is used on a standby 
basis until the information can be updated into the semipermanent memory area 
of the ESS. It is in the templar area that changes (or Recent Change Messages) 
are typed and held for updating into the semipermanent memory area (Recent 
Change Memory). 


The following Switching Systems (switches for short) that have Recent 
Change: 


- 1/1AESS 
—- 2/2BESS 
- 3ESS 

5ESS 

Remote Switching System (RSS) 
— #5ETS 

DMS100/200/250/300 


Here is a typical hookup. As you follow the diagram below, you will see: 


[1] Telephone subscriber connected to the Central Office by cables. 

[2] At the Central Office, each subscriber is connected to the Mai 

Distributing Frame. 

[3] The Cable and Pair is now connected to the Office Equipment (OI 
another location on the MDF. 


=) 


GJ 
ie) 
ct 


(Home Phone Lines) M.D.F. 
(Home Phone) 
(Home Phone) Veet fal Sp >a) D.S.S. 
(Home Phone) IN |ILLI/ |) le 
[pee ee es PPR Nh ot Equipment 
| /I/ \\ Job eens reg 
bef lip Se'|. SM aes 
Walsh [ely 
/ | 
Cables Cross-Connects 
[1] [2] [3] 


1. Office Equipment 


The Office Equipment (OE) is identified by a unique numbering plan. The 
equipment numbers identify the equipment location within the system. The 
Equipment Numbers also vary from one type of equipment to another. 


_ 


You also may find the OE (Office Equipment) referred to as the LEN (Line 
Equipment Number). It is called a REN (Remote Equipment Number) in a case of 
RSS (Remote Switching System). 
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Each telephone number is assigned to a specific equipment location where 
they bid for dial tone. 


Here is an example of different types of Office Equipment: 


1/1AESS #2ESS 
OF 004 -101-3 12 OF 011-2140 
/ nee | |/ | |/ | | I/ 
| | | | | | I || 
| | | Level | | | | Switch and Level 
|| Switch | | | Concentrator 
| Concentrator | | Concentrator Group 
Bay | Link Trunk Network 
Line Switch Frame Control Group 
Line Link 


Control Group 


#3ESS Others 

OF 001-214 0 1XB = XXXX-XXX-XX 
| |/ Pt otf 1XB = XXXX-XXXX-XX 
| | | | Level 5XB = XXX-XX-XX 
| | | | Switch SXS = XXXX-XXX 
| | Switch Group DMS-10 = XXX-X-XX-X 
It sf Concentrator 5ESS = XXXX-XXX-XX 
| Concentrator Group 5ESS = XXXX-XX-XX 
Control Group RSS = XXXX-X-XXXX 

DMS-1/200 = XXX-X-XX-XX 


2. How Does All This Fit Into RCMAC? 
RCMAC (Recent Change Memory Administration Center) is responsible for updating 
any Service Order activity. This action will change a customer line or servic 


in the Recent Change memory of the SPC switches. 
3. Function of RCMAC 
The three basic functions performed in RCMAC are: 
a. Coordination of Recent Change Source Documentation 
b. Processing of Recent Change Requests 
c. Administrative Responsibilities and Interface Groups 


In more detail: 


— Coordination of Recent Change Source Documentation 


The first function is the coordination of Source Documents. The main 
source of RC (Recent Change) is the Service Orders. Service Orders are changes 
in a subscriber’s service. RCMAC, in addition to the input of the service 


order in the switches, is responsible for other activities such as: 


—- Simulated Facilities (SFG) 
Route Indexes 
—- Traffic Registers (TR) 
- Subscriber Line Usages (SLU) 
Service Observing Assignment (SOB) 
— MARCH (MIZAR) RPM Updates 


Terminal Communications to the switches and/or MARCH (MIZAR) typically use 
the AT&T Datakit. RCMAC also is responsible for "HOT" requests from the I.C. 
(Installation Center) and other transmissions from the I.C. 


— Processing of Recent Change Requests 
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The second function of RCMAC is processing of RC messages. This involves 
inputting and editing RC messages in the switches. When RCMAC inputs messages, 
they are making a change to their customer’s service. The customers service is 


dependent on the prompt, accurate processing of RC source documents (Service 
Orders). 


The due date (sometimes referred to as the Frame Due Date) remarks and 
time interval assigned to the order will govern the release of RC input to ESS. 
Due date is important because this is the date that the Service Order has to be 
completed (going through the FACS system, frame work done, and RC message 
inputted into the switch). 


Recent Change Requests 


The RCMAC receives documentation for changes to the temporary memory areas 
of the various types of ESS equipment. These changes may come in many forms 
and from many different sources. 


Service Orders > Rig |) SSS >| ESS 
Line Station Transfer-—-—-—-—----- > Cc | 
Service Observing > M >| ESS | 
Special Studies > A | 
Trouble Reports > Cc 
Verifications Oe >| ESS 

Some Recent Changes requests are Service Orders, Line Equipment Transfers 
(LET), Service Observing Requests (SOB), Special Studies (SLU), Trouble Reports 
and Verification (follow local procedure). In short, it is taking this 


information and making the correct changes into the SPC switches. 
—- Administrative Responsibilities and Interface Groups 


—- Control of errors. 

—- Monitor activity. 

— Prepare administrative reports. 

—- Coordination of RCMAC operations and interface with other departments. 

—- Restore RC area of the switches in the event that RC memory is damaged 
due to machine failure. 


Operational Interface 


RCMAC must coordinate activities with many work groups to achieve accurate 
and quick RC for the ESSes. 


BSC/RSC & MKTG 


| 
SCC | RSB 
\ | / 
\ | / 
\ | / 
NAG ==-==--=+=+= RCMAC ---------- Ic 
/ \ 
/ \ 
/ \ 
Frame MLAC 


To help understand this better, here is a short description of each group 
that interfaces with RCMAC: 


SCC (Switching Control Center) 


- Technical assistance to RCMAC 

— Provide emergency coverage (off hours) for RCMAC. This includes 
service affecting problems. They also coordinate any updates in 
the ESS programs with RCMAC. 


7.txt 


Wed Apr 26 09:43:39 2017 6 


NAC (Network Administration Center) provides RCMAC with: 


Line Class Codes (LCC) like 1FR (l-party Flat Rate). 

List of numbers that must be changed (in ESS memory) from one intercept 
route index to another, prior to reassignment. 

Translation Assignments; Example: Simulated Facilities Group (SFG). 
Area Transfer/Dial for Dial Assignment. 


Frame 


Service Observing assignment. 

Subscriber Line Usages (SLU) study assignment. 

Customer Line Overflow study assignment. 

RPM updates for DMS 100 change in COSMOS tables USOC/NXX/Ltg. 


(Frame Jeopardy Reports) Central Office (FCC) will interface with RCMAC 


for Line Equipment transfers. 


Problems encountered by the frame group when completing Service Orders 
may be coordinated with the MLAC (Loop Assignment Center), or when 
appropriate will be called directly to RCMAC (i.e. No Dial Tone on a new 
connect). 


Business/Residence Service Center (BSC/RSC) and Marketing (MKTG) 


Repair 


The BSC/RSC and MKTG determine what kind of service the customer wants, 
generates Service Orders, and coordinates with RCMAC regarding special 
services to customers. 


Service Bureau (RSB) or Single Point of Contact (SPOC) 


Customer trouble reports may involve RC inputs; the RCMAC would work 
closely with RSB or SPOC to clear such troubles. 

RCMAC is responsible for analyzing, investigating and resolving customer 
trouble caused by RC input. 


Installation Center (IC) and/or Maintenance Center (MC) 


[The IC/MC group is responsible for the administration function 
associated with the completion and control of Service Order load. This 
invokes all orders whether they require field work or no field work. 
This Group is responsible for ensuring all service orders are taken car 
of on the proper due dat 


Mechanized Loop Assignment Center (MLAC) or LAC 


Assigns Service Orders for RCMAC. 
Assigns customers loops (this group is not in all BOCs). 


D. The FACS Environment 


To better understand RCMAC, Source Document flow, and a typical BOC as a 


whole, 


the FACS (Facility Administration Control System) is an important part 


of this. 


Systems in a FACS environment 


PREMIS 


SOAC 


— PREMises Information System 
This system is divided into three parts: the main PREMIS database, 
PREMLAC (Loop Assignment) and PREMLAS (Loop Assignment Special 
circuit). This contains customer and address inventory and assigns 
numbers. 


Service Order Analysis and Control 

This system receives Service Orders from SORD and interprets and 
determines facility requirements. The system requests and receives 
assignments from LFACS and COSMOS and forwards orders to MARCH, 
forwards assignments to SORD, and also maintains Service Order history 
and manages changes. 
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LFACS - Loop FACS contains all loop facilities inventory and responds to 
requests for assignment. 

COSMOS -— COmputer System for Mainframe OperationS contains all the OF inventory 
and responds for OE request. 

SORD Service ORder and Distribution distributes Service Orders throughout 
the system. 

MARCH — MARCH is the Mizar upgrade which will come into play when the 
Stromberg-Carlson (SxS and XBAR) is upgraded to Generic 17.1 (the 
software interface is called NAC). Though there is a problem with the 
interface between MARCH and COSMOS (because the Generic Interface is 
not supported by COSMOS), templates are used for MAN, AGE, LETS, etc. 
Anyway, MARCH plays a big part in this system. MARCH, aside from what 
was talked about above, has a basic function of keeping RCMAC up to 
date on the switches (MSR user transaction). It is an RC message 
manager which will allow one to modify messages (ORE), show usages 
(MAR) and logs all transmissions. 

BASIC ORDER FLOW 
PHASE I - COSMOS/MIZAR 

| | 

| Customer | 

| Request | 

| | 


V 
| 
SORD | 
| 
| 
V 
| | 
| | Work | 
SOAC i  Soe2se eee > | Manager | 
| | (WM) | 
| | 
| 
| 
V 
KOK KR OK KOK 
* | | 
* COSMOS * -------— > | MIZAR | 
* * | | 
OR SRS TR ROOK | 
| 
V 
| | 
| SPCS/ | 
| DIGITAL | 
| SWITCH | 
| | 
PHASE II - SOAC/MARCH 
| | 
| CUSTOMER | 
| REQUEST | 
| | 
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V 
| | 
| SORD | 
| | 
| 
| 
V 
| | | | 
| | | WORK | | | | SPCS/ | 
| SOAC [0 Se =S5 > | MANAGER | ------ > | MARCH | ---> | DIGITAL | 
| | | (WM) | | | | SWITCH | 
| | | 


Then There Was MLAC 


With conversion to FACS, a shift in the service order provisioning process 
was made from manual input by the LAC and NAC to mechanized data flow from SOAC 
to COSMOS (via Work Manager). Tables used for Recent Change (CFINIT, USL, and 
CXM) and spare OE assignments reside in COSMOS, along with the Recent Change 
Message Generator (RCMG). The LAC and NAC are now involved only on an 
exception basis (This will be explained in more detail later on). 


| SORD | 
—————s 
| 
| 
V 
—— | | 
| | --------- > | FACS levees 
| SOAC | | COMPONENTS | 
| | <--------- | FOR ASGNS. |--- 
| | | 
| 
V a a a Se aS 
* * 
| | Pre J | —— * 
| WM [eke I OneR OR. al | |  * RC 
| | * | 9 CFINIT |----> | RCMG | * ----- >| MARCH | 
* | o USL | [Ses | 
* | o CMX | 3 | 
r-| | + 
* * V 
COSMOS . 
a a a a a Se a ee a a a a aS | | 
l) <SPES7 - | 
| DIGITAL | 
| SWITCH | 
| | 


NOW THERE IS SOAC/MARCH 


With the SOAC/MARCH application (FACS/MARCH configuration), the primary 
source of service order data continues to be SOAC. COSMOS is taken out of the 
Recent Change business with this application (except, like the LAC and NAC, on 
an exception basis) and becomes just another FACS Component. The tables that 
resided in COSMOS or Recent Change are now duplicated in MARCH. 


Instead of retrieving, storing, and passing on already-formatted Recent 
Change messages, MARCH now generates the Recent Change from the data passed 
from SOAC, as did COSMOS previously. 
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| SORD | 
| | 
| 
| 
V 
a | | 
| Se = FACS |--- 
| SOAC | | COMPONENTS | 
| | <--------- | FOR ASGNS. |--- 
| | | 
| 
V KK KK KK KKK KK KKK KOKO KK 
* * 
| | a | ‘ 
| WM |---> * | o RPM | | |  =* RC | 
| | * | 9 CFINIT |----> | RCMG | * ----- > | SPCS/ | 
* | o USL | | |  * MSG | DIGITAL | 
* | | * | SWITCH | 
: : | | 
* MARCH * 
KK KK KK KK KKK KKK KK KK 


E. Getting Ready For Recent Change Message 


STARTING WITH SORD 


Service Orders (SORD) contain FIDS and USOCs (Universal Service Order 
Codes [these codes tell the type of service the customer may have or get]) 
followed by data specific to a customer’s service request (SORD accesses PREMIS 
for telephone number and address data; other entries are made by the Service 
Representative). The order is then passed to SOAC. 


THEN TO SOAC 


SOAC uses internal tables to read the FIDsS and USOCS passed by SORD to 
determine what information is required from the various components of FACS. 
SOAC then accesses the appropriate FACS components (LFACS for Cable Pair 
assignment; COSMOS for OE assignment) and gathers the required data. 


Once all the data has been collected, SOAC passes the information to the 
Work Manager. Data is either passed as is or translated by SOAC (again using 
internal tables) into language acceptable to the receiving systems (i.e., 
COSMOS and MARCH). 


SOAC passes information intended for MARCH in one of two ways: 
TP-Flow-Through Translation Packets 


Translation Packets (TPs) contain fully translatable data from which 
MARCH can generate a Recent Change message. Determination is made by 
SOAC based on the interface capabilities and its ability to read, 
translate as required, and pass data. 


Service Order Image 


Service Order Images are sent to MARCH if SOAC is not able to pass 
all required data. Images require additional information, either 
input manually or retrieved from COSMOS before Recent Change messages 
are generated. 


WORK MANAGER — THE TRAFFIC COP 


The primary function of Work Manager is to read the service order and 
determine where the data must be sent. Decisions include: 


COSMOS System MARCH System 
COSMOS Wire Center MARCH Switch 
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COSMOS Control Group Serving RCMA 


Work Manager passes the service order data to MARCH on a real time basis 


(orders that were previously held in COSMOS until requested by Frame Due Date 


[FDD] 


+ + + + + + FF FF F F F F F 


are now held in MARCH), either as a TP or an Image. 


A Translation Packet, passed from SOAC via Work Manager is received in 
MARCH by the CIP, Communication Interface Program. 


When data is received by the CIP, it calls up the CTI or Job Control 
Module. The Job Control Module or CTI writes the data that is received to 
a temporary file and informs TP Trans (Translation Translator) that an 
order has been received. It also controls the number of simultaneous jobs 
submitted to TPTrans. 


TPTrans analyzes the order in the temporary file, does appropriate FID 
conversion (such as stripping out dashes), reformats the order, and passes 
it to the Recent Change Message Generator (RCMG). 


RCMG performs all Recent Change message generation and, upon completion, 
writes the order into a MARCH pending file (Pending Header or Review 
file). 


In addition to the data passed from SOAC, RCMG uses the following data in 
MARCH to translate into switch-acceptable messages: 


NXX Switch Specific Parameters (RPM) 
USOC (RPM) CCF Keywords (CFINIT) 
USOC/NXX (RPM) Review Triggers (RVT) 


Release Times (SRM) 


* * * * * * * * * * * * * * * * * * * * * * 
M A R C H < 

* 

| | | | | | | . 

CIP | ----- lh CT sree Ss:) TR TRANS || ass > | RCMG | # 
| | | | | | | ¢ 

| /\ # 

| i a 

| / ‘ 

| | / * 

| / TMP [sq=ss4 / * 

* 

* 

* 


When MARCH Receives A Service Order Image 


A Service Order Image, passed from SOAC via Work Manager is received in 
MARCH by the CIP, Communication Interface Program. 


When the image is received by the CIP, it calls up the CTI or Job Control 
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Module. The Job Control Module or CTI writes the data that is received to 
a temporary file and informs TP TRANS (Translation Translator) that an 
order has been received. It also controls the number of simultaneous jobs 
submitted to TPTrans. 


(3) TP TRANS analyzes the order in the temporary file, sees that it is a 
service order image, and creates a SOI (Service Order Image) file using 
the order number and file name. Th ntire image is written to the SOI 
file. TP TRANS signals the Service Order Image Processor (SOIP) program 
for the remaining processing. 


(4) If SOIP can determine the switch for which the image is intended, it 
passes a request to the Call COSMOS file and stores the image data in the 
TH file (Image Header). If SOIP cannot determine the switch, the image is 
placed in the PAC (Unknown Switch Advisory) for manual processing. 


(5) For images where the switch has been determined, MARCH calls COSMOS at its 
next scheduled call time and runs RCP by Order Number (if the last call 
time is past, it will defer the request to the first call time for the 
next day). 


(6) If the order is received from COSMOS, it is placed in the PH or RV file 
appropriately and the Image Header is purged. A flag is set indicating 


that a Service Order Image text exists in the system. If the order is not 

received from COSMOS, the image is placed in the PAC for manual 

processing. 
* * * * * * * * * * * * * * * * * * * * * * * * 
*. M A R C 4H bas 
* * 
rg | | | | | | | * 
m | CIP | Sse > | CTI |, 2-S=5 > | TP TRANS| ----- > | RCMG | * 
a Al | | | | | | | * 
i | /\ | * 
ms | / | * 
* | / V * 
* | | i: | | * 
ig | / TMP etal ae rae | /SOI | 7 
* | | | | - 
* * 
* * * * * * * * * * * * * * * * * * * * * * * * 


It is not necessary for you to know all the programs MARCH uses to process 
Service Orders in a SOAC/MARCH environment. That gets trivial and all stuck in 
various commands that do not mean anything unless, of course, one is on the 
system at hand. 


TP | | TP TP | | 
| | ------- > | “Werke i] e=s5== > | | ----- eile TSeee yr. «| 
| SOAC | Image | Manager | Image | MARCH | Image | Digital | 
| | =======> | (WM) J s=ess===> [| | Se ==> || «6 Switch | 

| | | | 

feck “Oe 
Ie dh | | 
ae | | 
VV | 

KOK KR Fok Ke KK 

* * 

* COSMOS . 

* * 

* * 


kK KK Kk Kk OK 
| 
| 
| 


Though it is trivial to understand just how all these system work, here is 
a rough overview of MARCH. To Cover MARCH, this will first cover the 
background processing. 
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F. MARCH Background Processing 


RECENT CHANGE PARAMETER (RPM) 


In conjunction with ORI Patterns and Recent Change Templates, the RPM 
determines how information from SOAC is changed and/or manipulated to create 
acceptable switch Recent Change messages. 


RCMA Supervisor has overall responsibility for the RPM. Although specific 
categories may be maintained by Staff Manager, it is overviewed by RCMAC as a 
whole. 


This includes Line Class Code (LCC) conversion data previously under the sole 
responsibility of the NAC in COSMOS. It requires a change of procedures for 
t 
a 


he RCMA to ensure proper LCC information is passed on the RPM and updated 
ppropriately. 


Initial USOC is LCC conversion data and will be copied into MARCH from the 
COSMOS USOC Table. 


SWITCH RELEASE MANAGER (SDR) 


With SOAC/MARCH, it no longer determines the types of orders to be pulled 
from COSMOS, and thus establishes the date and time orders are to be released 
to the switch, coming both from SOAC and from COSMOS. 


It is based on Package Type (PKT) and Package Category (PKC) 
SWINIT TRANSACTION 


Contains switch-specific data for MARCH to communicate with SOAC (via Work 
Manager), COSMOS, and the switch. 


Establishes the call times for COSMOS. 


— RCP by Order Number for Service Order Images. 
- Suspends, Restores, and Nonpayment Disconnects. 


—- Automated AGE Requests (as applicable). 
Automated MAN Report. 


SDR - SWITCH DATA REPORT 
SDR is a report transaction intended for use by the RCMA Associate. 
The Switch Data Report provides a printout of the SWINIT information that was 
populated from the Perpetrations Questionnaire submitted by the RCMA 


Supervisor (see Order Description part of this file). 


MOI of an Order in History 


Orders in the History Header (HH) file will reflect the history source. The 
history source indicated how the order was written to the history file. 


G. User Transaction in MARCH 


Most Commonly Used MARCH Commands 


Transaction Name Function Search keys Prompts 
MSR <CR> MARCH Status |office status . <CR> ae = 
Report sw address 
MOI <CR> MARCH Order status of fn rv Se== 
Inquiry order, tn, fn rj 
file fn hh/adt xx-xx 
so n12345678 
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tn XXXXXXX 
ONC <CR> On Line Access COSMOS |  ) ------ login 
COSMOS password 
ONS <CR> On Line Access Switch | = ------ Switch 
Switch logon 
ORE <CR> Order Edit Edit Header or Bn. BV SSeS 
message text fn rj 
of MARCH file so n12345678 
tn XXXXXxXX 
ORE -G <CR> Order Edit edit multiple 2 Search keys aaa! 
Global files Required 
ORI <CR> Order Input Build MARCH | = ------ Patterns 
file 
ORS <CR> Order Send Send to Switch so n12345678 SSeS 
immediately tn XXXXXXX 
TLC <CR> Tail COSMOS watch MARCH | 9 =------ SSS 
pull orders 
TLS <CR> Tail Switch Watch orders 
sent to switch 
VFY <CR> Verify Request Verify| = 9 ------ rltm,type 
tn,oe, hml 
VFD <CR> Verify Show Completed| = 9 ------ cicacrt 
Display verifies 
VES <CR> Verify Status| Show pending | = ------ 
verities 


Here is a detailed explanation 


MOI 


— MARCH ORDER INQUIRY 


of some of the commands: 


MOI is a conversational inquiry transaction intended for use by the RCMAC 


Clerk. 


MOI is used to inquire on Recent Change messages in a pending file(s): 


Pending Header, 
inquire on on 


Piske; 


ONS 


Review, 


Reject, 
ntir 


and/or History Header. 


message, an 


—- ON line Switch 


DMS-100 
Login 


1A 


1) 


2) At the "?" prompt type 

3) There will be an " 

4) 
password. 

5) Once on, type "S 
switch. 

Logout 

1) Type "LOGOUT" 


GJ 


SS 


Give a Hard Break 


or all orders ina file, 


ERVORD" 


order, 


Each switch has its own login sequence. 


W login" 


Enter User Name" 


and CONTROL-P 


prompt. 
hen "Enter Password" with a row of @, *, 


It may be used to 
several messages in more than one 
determined by the search keys entered. 


Enter th 
& and # covering the 


user nam 


and you are on the RC channel of the 


CONTROL-D" and each RC message with 
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Login 
1) Set Echo on, Line Feeds on and Caps Lock on. 
2) End each VFY message with " 
"! CONTROL-D". 
Logout 
1) Hit CONTROL-P 
5ESS 
Login 
1) Type "rcv:imenu:apprce" at the "<" prompt. 
Logout 
1) Type "Q" and hit CONTROL-P 
ONC - On Line COSMOS 


1) You will see 


"Logins" 


"Password:" prompt to enter password. 


ORE 


—- Order Edit 


ORE 


a 


point in the ORE 


movement commands: 
Commands 


N (ext header) 


M (ore text) 


P (revious header) 
B (ackup text) 
S (earch window) 


Control-D 


Control-U 

< 

> 

Q (uit) 
ORE -G 

ORE 

associate. 


ORE -G is used 
pending file: 
include adding 


ORE -G is also 


ORI - ORder Input 


ORder Input enables one to input an order and c 
that can be made are in th 


-G is a conversational transaction 


to globally edit Recent 
Pending Header, 
information on an order. 


Description 
Replaces the data on the scree 
associated text that matches t 


next message associated with t 
multiple text message). 
Replaces data in the header wi 


you looked at previously (in t 
Moves the cursor to the search 
additional search keys to be e 
Next Page 

Previous Page 


Quit 


intended for 


Review, and Reject. 


used to change header information and to remov 


telephone number, OE, 


complex to really get into here. 


VFY - Verify 


This is used to manually input verify messages into MARCH, 


switches. 


hange orders. 
so on. 


so type in username and then there will be a 


Commands are used to move between windows and to previous and subsequent 
headers and text within an editing session. Commands may be input at any 
session regardless of the cursor location. 


letters requiring use of the shift key or control commands. 


They are capital 
Here are the 


n with the next header and 
he search keys entered. 


Replaces the data in the message text window with the 


he existing header (for 


ndows with the header you 


looked at previously (in the same editing session). 
Replaces data in the message text window with the text 


he same editing session). 
window permitting 
ntered. 


Move cursor from text window to header. 
Moves to text window from header. 


use by the RCMA 


Change messages existing in a MARCH 


Editing capabilities 


messages. 


The changes 
This command is too 


thus to the 
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MSR -— MARCH Status Report 


This used to count the amount of service orders stored in SOAC. 
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It also 


shows the amount of change messages that have been sent to the switch. 


H. Service Order Forms 


In my time, 
me. After several months, 
are what some of the common 


SORD Service Order: 


servic 


I have come across a lot of printouts that hav 
I could start to understand some of th 


orders ar 


mad 


to 


no sens 


codes. 
and what they are for. 


TN CUS TD DD APT MAC ACC AO cS SLS HU 
415-343-8765 529 T DUE W AS OF 1FR ABCDE4W 
ORD SU EX STA APP CD IOP CT TX RA SP CON AC 
C14327658 SMIUX R R 
ACNA R 
WA 343# EXETER, SMT 
WN IDOL, BILLY 
---S&E 
Tl ESL 
Ol 1FR/TN 343-8321/ADL 
/PIC 10288 
Ol ESL/FN 3438321 
---BILL 
MSN IDOL, BILLY 
MSTIN 555-1212 
—--RMKS 
RMK BLAH 
[KKK END 
[1] [2] [3] [9] 
| | | | 
TN CUS TD DD APT MAC ACC AO cS SLS HU 
407-343-8765 529 T DUE W AS OF 1FR ABCDE4W 
[8] 
| 
ORD SU EX STA APP CD IOP CTI TX RA SP CON AC 
C14327658 SMIUX R R 
ACNA R 
[4] 
| 
WA 343# EXETER, SMT 
[6] 
WN AT&T 
---S&E \ 
Tl ESL | 
Ol 1FR/IN 343-8321/ADL | [5] 
/PIC 10288 | 
Ol ESL/FN 3438321 / 
---BILL 
[6] 
| 
MSN IDOL, BILLY 


Her 


MSTN 
—--RMKS 
RMK BLAH 


555-1212 


/**** END 
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Telephone Number. 
Customer number. 
Due Date. 

Work Address. 

The S&E field: 


OB WNER 


Format is XXX-XXX-XXXxX. 


ACTION CODE -- This is the code at the far left-most side of the pag 


codes end with al ora 0. 
the 0 says to not do th 
Here is a list: 


action codes. 


featur There ar 


Action Code Used to 

I Add features 

O Remove features 

C-T Change designated number of rings, "forward to" number, 
both on Busy/Delay call forwarding features. 

E-D Enter or Delete a feature for record purposes only. 

R Recap CCS USOC to advise 


Here is a list of some common USOCs (features): 


Billing name 
Billing number 
Service Order Number 


WO @OrAID 


SDR File Header Information Order 


Switchname 
Header File Nam 


Service Order Number 
Servic 
Telephon 


Order Typ 
Number 


Do PB WN EE 


History Header File 


[1] [2] 
| | 


sw: swad0 


7 
8. 
Current Date & Time 9. 
0 
1 


history header file 


ESC Three Way Calling 

ESF Speed Calling 

ESL Speed Calling 8 Code 

ESM Call Forwarding 

ESX Call Waiting 

EVB Busy Call Forward 

EVC Bust Call Forward Extended 
EVD Delayed Call Forwarding 
HM1 Intercom Plus 

HMP Intercom Plus 

MVCCW Commstar II Call Waiting 


Class of Service or LCC (See appendix 1) 


(MARCH) 


Package Type 
Package Category 
Reject Reason 
Release Date & Time 
Accept Date & Time 
Reject Date & Time 
Input Source 


[3] 
| 


fri may 31 07:50:12 1992 


[The 1 says to add this feature and 
several different 


or 
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[4]- so=janet3 tn= pkt-in pkc=other 
[11]- act=05-30 0750 src=ori | | 
history text= | [6] [7] [8] 
FOPSelTst: [12] 
ord 31235 
cx =031235 
adn 2 
Wee 
Reject File 
[l]- sw:swad2 [2]- reject file [3]- fri may 30 11:22:01 1992 

[4]- so=c238 [5]- ver=7 tn=5551212 -[6] 

[9]- rj reason=ot rldt=05-30 1059 rjdt=05-30 :106 src=cosmos 
message test= | | | 
re:line:chg: [10] pe] [12] 
ord 87102 
"=238-7102’ 

"ord. ¢231" 

"restoration from ssv-db" 

tn. 555° 1272 

lec Iimr 

rad 

ve data= 

COL, 

m O07 rcel8 0 87102 0 4 valar 
new 00001605 err 00000307 
05/30/92 11:07:16 

I. COSMOS Service Order From The SOI Command 

WC% 

wcs SOI 

H ORD N73322444 

DEG 1:9; 19:92 10:12:21 AM 
SERVICE ORDER ASSIGNMENT INQUIRY 

ORD N733224444-A OT (NC) ST (AC— ) FACS (YES) 

DD (12-20-92) FDD(12-20-92) EST(11-16:14) SG(G) DT (XX ) OC (COR) 
MDF WORK REQ(YES) MDF COMPL(NO) LAC COMPL(NO) RCP (NO) 

WPN 9446 WLST 1= P 2= 3= 5 6 7= 8= 
COORDINATION REQUIRED 

RMK FA BCC,RO D77901070 

RMK FAT TBCC,RO D77901070 

CP 48-0942 
ST SF PC FS WK DATE 11-28-89 RZ 13 
LOC PFO1008 

OE 012-25-006 
Sr SE PC FS WK DATE 11-12-91 CZ 1MB US 1MS FEA TNNL 
PIC 10288 
LCC BB1 
CCF ESX 
LOC PFO1007 

TN BT =5425 
ST WK PD FS WK DATE 12-03-91 TYPE X 

**ORD D77901070-C OF CD. -ST AC DD 12-20-92 FDD 12-20-92 

** SOI COMPLEATED 

WC% 
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WC% 


WC% SOI 


H ORD N73322444 
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[l]- DEC 19, 1992 10:12:21 AM 
[2]- SERVICE ORDER ASSIGNMNET INQUIRY 
[3] [4] [5] 
aa N733224444-A Nis ome: ) FACS (YES) 
[7] [8] [6] [9] 
eee an ee pose sec acae as A DT (XX ) OC (COR) 
[10] [11] [12] [13] 
ae WORK REQ (YES) COMPL (NO) ae COMPL (NO) setae) 
WPN 9446 WLST 1= P 2= 3= 4 5 6 7= 8= 
COORDINATION REQUIRED 
RMK FAT TBCC,RO D77901070 
RMK FAT TBCC,RO D77901070 
[35] 
ee 48-0942 
[34] [35] [36] [37] 
Ss SF PC - WK ate 11-28-89 : 13 
LOC PFO1008 -[39] 
OE 012-25-006 -[19] 
[20] [21] [22] [23] [24] [25] 
- SE <PG ne WK Bae 11-12-91 & 1MB = 1MS aur TNNL 
PIC 10288 
LCC BB1 -[27] 
CCF ESX -[26] 
LOC PFOQ1007 —[32] 
TN 571-5425 —-[14] 
[15] [16] [17] [18] 
- WK PD a WK ee 12-03-91 ae xX 
[38] [28] [29] [30] [31] 
bes D77901070-C oe CD = AC- P 12-20-92 au 12-20-92 
** SOI COMPLETED -[40] 
WCS -—-[41] 
1] Date and Time the SOI was Requested in COSMOS 
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Title of Output Message 

Order Number 

Order Type 

Status of Order 

EST (11-16:14) When Service Order was Established into COSMOS 
Due Date 

Frame Due Date 

Segment Group 

0] Main Distributing Frame Work Required 
] Main Distributing Frame Work Complete 
] Loop Assignment Center Completed 

] FACS Y 


PrRFRRrRFO WTA OB WN 


Wh 


>-- The order has downloaded from SOAC to MARCH (MARCH) 
RCP N 


14] Telephone Number 

15] Present State of Telephone Number 

16] Future Status of Telephone Number 

17] Date of Last Activity on Telephone Number 
18] Type of Telephone Number 
19] Line Equipment 
20] Present Status of Line Equipment 
21] Future Status of Phone Line 
22] Date of Last Activity on Line Equipment 

23] Class of Service 

24] USOC 

25] Features 

26] Custom Calling Feature 

27 sine Class Code 

28] Order Type that is Clearing Telephone Number 

29] Status of Order that is Clearing Telephone Number 
30] Due Date 

31] Frame Due Date 
32] Location of Line Equipment on Frame 

33] Cable and Pair 

34] Present Status of Cable and Pair 

35] Future Status of Cable and Pair 

36] Date of Last Activity on Cable and Pair 

37] Resistance Zone 

38] Order Number Clearing Cable 

39] Location of Cable and Pair on Frame 

40] SOI Complete Message 

41] Wire Center and Prompt Symbol to Indicate Computer is Ready for Another 
Transaction 

42] Primary Independent Carrier is 10288 (AT&T’s Ten Triple X Code) 


J. MSR —- MARCH Status Report (MARCH) 


switch name 


march status report 
sw:switch name tue oct 30 11:14:48 1992 
pending work functions 


past due due today future due 
use moi for: 0 0 0 
reject file 0 1 270 
review file 0 0 0 
held release status 28 14 44 
normal release status 0 7 184 


use pac for: 0 15 
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change notices 0 
unknown switch notices 0 0 


Ww 


** msr completed 


switch name 


| march status report 
sw:switch name [2]- tue oct 30 11:14:48 1992 
pending work functions 


[3] [5] [12] 
| | | 
past due due today future due 

use moi for: 0 2: =f 0 
reject file 0 1 -[7 0 
held release status 5 -[4] 6 -[8 0 
normal release status 0 3 -[9 3 -[13] 
use pac for: 0 15 -[10] 
change notices 0 3a [0] 
unknown switch notices 0 0 


** msr completed 


0) 


PRRPRPOWDATAOBPWNE 


wh 


] 
] 
] 
] 


Office MSR request in (switch name/address) 
Date and time of request 

Past due service order column 

Past due service order on hold 

Due today service order column 

Order due today in the reject file 

Orders due today in review file 

Orders due today on hold 
Orders due today with a normal release status 

PAC service orders which have been changed 

PAC switch advisory notices encountered today 

Future due service order column 

Order due in the future with a normal release status 


K. Other Notes 


LCC or Line Class Code is, in short, what kind of line the Bell customer 


may have. They are the phone line type ID. These IDs are used by the SCC 
(Switching Control Center) and the switches as an ID to what type of billing 
you have. Here is a list of some common LCCs that a standard BOC uses. 
Note: This is not in stone. These may change from area to area. 

1FR - One Flat Rate 

1MR One Measured Rat 

1PC - One Pay Phone 
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CDF - DTF Coin 

PBX - Private Branch Exchange (Direct Inward Dialing ext.) 
CFD - Coinless ANI7 Charge-a-Call 

INW - InWATS 

OWT —- OutWATS 

PBM - 0 HO/MO MSG REG (No ANT) 

PMB -— LTG = 1 HO/MO Regular ANI6 


L. Recommended Reading 


Agent Steal’s file in LODTJ #4 
Acronyms 1988 [from Metal Shop Private BBS] (Phrack 20, File 11) 
Lifting Ma Bell’s Cloak Of Secrecy by VaxCat (Phrack 24, File 9) 
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==Phrack Inc.== 


Volume Four, Issue Forty, File 8 of 14 


BT Tymnet 
British Telecom 


Part 1 of 3 
Presented by Toucan Jones 


August 1, 1992 


"We played an instrumental role in first recognizing that they were there." 


"If you mess with our network and we catch you 
—- which we always do -- you will go down." 


-—- John Guinasso, director of global network security for Tymnet parent 
BT North America in Information Week (July 13, 1992, Page 15). 


Welcome to Tymnet! 


A. BT Tymnet Access Location Index 

B. BTI-GNS Access Within Regional Bell Operating Companies 
Bell Atlantic 

BellSouth 
Pacific Bell 
Southwestern Bell 
. Southern New England Telephone 

C. Database or Timesharing Companies on Tymnet 

D. Service Classifications For Database or Timesharing Companies Using Tymnet 
E. Summary of Global Network Services By Country 
FE 

G 


OP WN EF 


Terminal Identifiers 
Login Options 


H. BI-GNS Worldwide Asynchronus Outdial Service 


PART 3 
I. BT-GNS Worldwide Access Sorted By Node 


A. BT Tymnet Access Location Index 


Country Abbrev. Country Abbrev. 
ANTIGUA ATG HONG KONG HKG 
ARGENTINA ARG ISREAL ISR 
AUSTRALIA AUS ITALY ITA 
AUSTRIA AUT JAMAICA JAM 
BAHAMAS BHS JAPAN JPN 
BAHRAIN BHR KOREA KOR 
BARBADOS BRB NETHERLANDS NLD 
BELGIUM BEL NORTHERN MARIANAS SAP 
BERMUDA BMU PANAMA PAN 
CANADA CAN PERU PER 
CAYMAN ISLANDS CAY PHILIPPINES PHL 
COLUMBIA COL PURERTO RICO PRI 
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DENMARK DNK SWEDEN SWE 
DOMINICAN RPUBLIC DOM SWITZERLAND CHE 
EGYPT EGY TRINIDAD AND TOBAGO TTO 
FRANCE FRA UNITED KINGDOM GBR 
GREECE CRC URUGUAY URY 
GUAM GUM USA USA 
GUATEMALA GTM VIRGIN ISLANDS VIR 
HONDURAS HND WEST GERMANY DDR 


B. BI-GNS Access Within Regional Bell Operating Companies 


TYMNET has gateways into many of the Regional Bell Operating Companies’ packet 
networks. For specifics on how to access these networks, please refer to the 
information listed at the end of this listing. 


DIALUP ACCESS M 
PROV 100’s bps N 

NODE CITY ST CNTRY DENS 3.12 24 96 ACCESS NO. P COMMENTS 
02275 Birmingham AL USA MED BB C 205/822-8629 N @PLSK 
03306 Berkeley CA USA MED BB 510/548-2121 N @PPS 
03306 Berkeley CA USA MED C 510/548-5743 N @PPS 
06272 El Segundo CA USA MED BB 310/640-8548 N @PPS 
06272 El Segundo CA USA MED C 310/640-0350 N @PPS 
06272 Fullerton CA USA MED BB 714-441-2777 N @PPS 
06272 Fullerton CA USA MED Cc 714/441-1839 N @PPS 
06272 Inglewood CA USA MED BB 310/216-7667 N @PPS 
06272 Inglewood CA USA MED C 310/216-4469 N @PPS 
06272 Los Angeles CA USA MED BB 213/480-1677 N @PPS 
06272 Los Angeles-Downtn. CA USA MED BB 213/687-3727 N @PPS 
03306 Mountain View CA USA MED BB 415/960-3363 N @PPS 
03306 Mountain View CA USA MED Cc 415/961-2102 N @PPS 
03306 Oakland CA USA MED BB C 510/893-9889 N @PPS 
03306 Palo Alto CA USA MED BB 415/325-4666 N @PPS 
03306 Palo Alto CA USA MED C 415/323-2019 N @PPS 
06272 Pasadena CA USA MED BB 818-356-0780 N @PPS 
06272 Pasadena CA USA MED C 818/356-0487 N @PPS 
03306 San Francisco CA USA MED BB 415/362-2280 N @PPS 
03306 San Francisco CA USA MED BB C 415/543-8275 N @PPS 
03306 San Francisco CA USA MED BB 415/626-5380 N @PPS 
03306 San Francisco CA USA MED BB C 415/626-7477 N @PPS 
03306 San Francisco CA USA MED C 415/362-7579 N @PPS 
03306 San Jose CA USA MED BB 408-920-0888 N @PPS 
03306 San Jose CA USA MED € 408/298-0584 N @PPS 
06272 Santa Ana CA USA MED BB 714-972-9844 N @PPS 
06272 Santa Ana CA USA MED Cc. 714/972-2314 N @PPS 
06272 Van Nuys CA USA MED BB 818-780-1066 N @PPS 
06272 Van Nuys CA USA MED C 818/780-5468 N @PPS 
02727 Bridgeport CL USA MED BB C 203/366-6972 N @CONNNET 
02727 Bristol Gul USA MED BB C 203/589-5100 N @CONNNET 
02727 Canaan CT. USA MED BB: 2C 203/824-5103 N @CONNNET 
02727 Clinton CT USA MED BeB ne 203/669-4243 N @CONNNE 
02727 Danbury CLE USA MED BB C 203/743-2906 N @CONNNE 
02727 Danielson CT USA MED BB C 203/779-1880 N @CONNNE 
02727 Hartford/Middletown CT USA MED BB C 203/724-6219 N @CONNNE 
02727 Meriden CT USA MED BB C 203/237-3460 N @CONNNE 
02727 New Haven Cr USA MED BB C 203/776-1142 N @CONNNE 
02727 New London CT. USA MED BB C 203/443-0884 N @CONNNET 
02727 New Milford CT USA MED Biu.Be ¢- 203/355-0764 N @CONNNET 
02727 Norwalk CL USA MED BB C 203/866-5305 N @CONNNET 
02727 Norwich/New London Cr USA MED BB C 203/443-0884 N @CONNNET 
02727 Old Greddwich Cr USA MED BB C 203/637-8872 N @CONNNET 
02727 Old Saybrook CT USA MED B-By + 203/388-0778 N @CONNNE 
02727 Seymour CE USA MED BB C 203/881-1455 N @CONNNE 
02727 Stamford Cz USA MED BB. ve 203/324-9701 N @CONNNE 
02727 Storrs CL USA MED BB C 203/429-4243 N @CONNNE 
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St. Augustine 
Stuart 

W. Hollywood 
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B=BEL 
C=CCI 
mod 
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Scranton PA USA MED Cc 
Scranton PA USA MED BB 
Sharon PA USA MED BB 
Tullytown PA USA MED BB 
Uniontown PA USA MED BB 
Valley Forge PA USA MED BB 
Washington PA USA MED BB 
Wayne PA USA MED BB 
Wilkinsburg PA USA MED BB 
Alexandria VA USA MED BB 
Arlington VA USA MED BB 
Mclean VA USA MED BB 

L 103/113 (300 bps) or BELL 212A (1200 bps) 
TT V.21(300 bps) or CCITT V.22 bis(2400 bps) 


ems. 


compatible modems 


17/341-1860 N 
17/348-1123 N 
12/342-1681 N 
15/547-3300 N 
12/437-5640 N 
115/270-2970 N 
12/223-9090 N 
15/341-9605 N 
12/241-1006 N 
703/683-6710 N 
703/524-8961 N 
703/848-2941 N 


DO BN PNM AB ~~ 


NN 


or CCITT V.32 com 


QDOOAA OO OA ® @A @® @@® 


BU De TA ST EO RE «UD. 


Bl. Bell Atlantic 
@PDN BELL ATLANTIC - NETWORK NAME IS PUBLIC DATA NETWORK (PDN) 
(CONNECT MESSAGE) 
<CR> (SYNCHRONIZES DATA SPEEDS) 
WELCOME TO THE BPA/DST PDN 
*.T <CR> (TYMNET ADDRESS) 
131069 (ADDRESS CONFIRMATION —- TYMNET DNIC) 
COM (CONFIRMATION OF CALL SET-UP) 
-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 
B2. BellSouth 
@PLSK BELLSOUTH —- NETWORK NAME IS PULSELINK 
(CONNECT MESSAGE) 
<CR> (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 
CONNECTED 
PULSELINK 
13106 (TYMNET ADDRESS) 
(DOES NOT ECHO TO THE TERMINAL) 
PULSELINK: CALL CONNECTED TO 1 3106 
—-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 
B3. Pacific Bell 
@PPS PACIFIC BELL — NETWORK NAME IS PUBLIC PACKET SWITCHING (PPS) 
(CONNECT MESSAGE) 
-<CR (SYNCHRONIZES DATA SPEEDS) > 
(DOES NOT ECHO TO THE TERMINAL) 


ONLINE 1200 
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WELCOME TO PPS: 415-XXX-XXXX 
131069 (TYMNET ADDRESS) 
(DOES NOT ECHO UNTIL TYMNET RESPONDS) 


-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 


B4. Southwestern Bell 


@MRLK -— SOUTHWESTERN BELL TELEPHONE- NETWORK NAME IS MICROLINK II(R) 


i) 
aA 

ea 
> 
n 
4 
K 

U 
K 
— 
a 
vs) 
H 

7] 


ERMINAL IDENTIFIER) 


A (YOUR TERMINAL IDENTIFIER) 


WELCOME TO MICROLINK II 

-XXXX:01-030- 

PLEASE LOG IN: 

~L <€R> (USERNAME TO ACCESS TYMNET) 


HOST: CALL CONNECTED 


-GWY OXXXX- TYMNET: PLEASE LOG IN: 


B5. Southern New England Telephone 


5 


@CONNNET - SOUTHERN NEW ENGLAND TELEPHONE -—- NETWORK NAME IN CONNNET 


HH<CR> (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 

CONNNET 

. T<CR> (MUST BE CAPITAL LETTERS) 

26-SEP-88 1:33:33 (DATA) 

031069 (ADDRESS CONFIRMATION) 

COM (CONFIRMATION OF CALL SET-UP) 


-GWY OXXXX-TYMNET: PLEASE LOG IN: 


C. Database or Timesharing Companies on Tymnet 
APCUG "GLOBALNET" BBS 
Bloodstock Research Information 
BRS Information Technologies 
BT, North America (Dialcom) 
Cartermill, Inc. 
Charles Schwab and Company, Inc. 
Chemical Abstracts Services (CAS) 
Commercial SABRE 
Commodity Systems, Inc. 
CompuServe, Inc. 
Compusource 
Computer Intelligenc 
Connect, Inc. 
Creative Automation Co. 
Delphi 
Dialog Information Services, Inc. 
Digital Equipment Corp. 
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Diversified Network Applications, Inc. 
Dow Jones & Company, Inc. 

Dun and Bradstreet 

Electronic Data Systems Corp. 
Export Network, Inc. 

Gibson Information Systems (GIS) 
Global Interconnect Communications, 
Idioma Translation 
Interactive Data Corp. 
Jeppesen DataPlan 

Mead Data Central 

Metro On-Line Services, Ltd. 
National Library of Medicine 
NewsNet, Inc. 

Nikkei Telecom Japan 
Nuclear Power Experienc 
OCR Services, Inc. 
Official Airline Guide 
ORBIT Search Service 
Power Computing Company 
Rand McNally - TDM, Inc. 

Real Estate Investment Network 
SeniorNet 

Southeast Regional Data Center (SERDAC) 
SPEED>S Corporation 

The Jockey Club Information Systems 
TRW Business Credit Division 

TRW Information Services 
USA TODAY Sports Center 
West Publishing Company 
Xerox Computer Services 


Tine. 


(NLM) 


(OAG) 


(WEST) 
(XCS) 


D. Service Classifications For Database or Timesharing Companies Using Tymnet 


MAJOR CATEGORIES: 


Business 
Communications 
Computers 
Economics 
Education 
Electronic Mail 
Environment 
Finance 

Games 

General Interest 
Government 
Health Care 
Insurance 
International 


OTHER CAT 


EGORIES 


Accounting 
Airlines 
Asia 
Aviation 
Batch 
Car 
Chats 
Chemistry 
Commodities 
Computing 
Conferences 
Corporate 


(Processing) 


Investments 
Legal 
Livestock 
Marketing 
Medicine 
Natural Resources 
Real Estate 
Safety 

Science 

Sports 

Trade 
Transportation 
Travel 


Law 
Management 
Manufacturing 
Market Analysis 
Mines 

Network 

News 

Nuclear Power 
Outsourcing 
Patents 

PC 

Racing 
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BT TYMNET’s Global 


services: 


1. BT 


2. ENHANCED G 
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Credit (Business or Consumer) 
Data (Processing) 
Direct Marketing 
Disaster Recovery 
DMV 

Electric Power 
Engineering 

Export 

Fax Services 
Fictitious Names 
Flight Plans 

Hotel 

Horses 

Information 
Instruction 

IRS (Internal Revenu 
Japan 

Languages 


Service) 


Network Service (GNS) 


combines thr 


Records 
Registration 
Research 
Reservations 
RJE 
Route Planning 
Schedules 

SEC 

Securities 
Software 

Tax 
Timesharing 
Translation 
UCC 

User Group 
Vendors 
Weather 


lev 


TYMNET GLOBAL 


NETWORK CONNECTION SERVIC 


5 


sXOBAL CONNECTION S 


IRVIC 


ry 


IRVICE 


[J 


(TGN) 


3% BASIC GLOBAL CONNECTION SERVICE 

BT TYMNET GLOBAL NETWORK CONNECTION SE 
following countries: 

Australia Netherlands 

Belgium New Zealand 

Canada Spain 

Denmark Sweden 

France Switzerland 

Germany United Kingdom 

Italy United States 

Japan 


BT TYMNET GLOBAL NETWORK CONNECTION SERVICE are BT TYMNET owned and operated 
1 support is provided end-to-end 


sites and equipment. Global, 


Regional 


and loca 


by BT TYMNET’s trained and 


since 1977. Round t 
critical problems is provided. 
pricing, local 


xperienced technical 
le reporting and response on 
Network Servic 

lable. 


he clock coverage for troubl 


currency billing and end-user bil 


staff, in pl 


1 of international 


is currently offered in the 


lace worldwide 


nhanced 


BT TYMNET Global 


ling is avai 


ENHANCED GLOBAL CONNECTION SERVICE (EGC) complement the servic 
and is currently available from the following locations: 
Alaska (USA) * Israel 
Antigua Italy 
Argentina Jamaica 
Australia Korea 
Austria Netherland Antilles 
Bahama Panama 
Bahrain Peru 
Barbados Philippines 
Belgium Puerto Rico* 
Bermuda Saudi Arabia 
Cayman Islands Sweden 
Denmark Switzerland 
Dominican Republic Tortola 
France Trinidad and Tobago 
Germany United Kingdom 
Guam* US Virgin Islands 
Guatemala 


Honduras 


described above 
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Hong Kong 


* USA Domestic services and rates apply 


ENHANCED GLOBAL CONNECTION SERVICE is offered by a local Telecommunication 
Administration equipped with BT TYMNET technology. In many instances the 
administration is using BT TYMNET’s Network Supervisors to operate the packet 
service in their area. 


1 ENHANCED GLOBAL CONNECTION SERVICE locations offer direct TYM2 (TYMNET’s 
roprietary) protocol connection to the BT TYMNET Public Network and thus may 
ffer BT TYMNET’s comprehensive array of enhanced protocol services. Most 
urrently offer BIT TYMNET asynchronous access and X.25 service. Naturally, a 
close affinity exists between BT TYMNET and ENHANCED GLOBAL CONNECTION SERVIC 
providers so a very high degr of service and support exists in these 
locations. TYMUSA, a universal dial-up service which is billed back to the 
customer’s home office, is offered from all the above locations. 


QaowD 


[7] 


BASIC GLOBAL CONNECTION SERVICE (BGC) completes the full range of international 
connectivity and is currently available from the following locations: 


Antigua Greenland* Panama 
Argentina Gudaelope* Peru 

Australia Guam & Saipan Philippines 
Austria Guatemala Portugal 
Bahamas Honduras Puerto Rico 
Bahrain Hong Kong Qatar 

Barbados Hungary Reunion Island 
Belgium Iceland Saudi Arabia 
Bermuda India San Marino* 
Brazil Indonesia Senegal* 
Canada Ireland Singapore 
Cayman Islands Israel South Africa 
Chile Italy South Korea 
China Ivory Coast Spain 

Colombia Jamaica Sweden 
CostaRica Japan Switzerland 
Curacao Kuwait Taiwan 

Cyprus* Luxembourg Thailand 
Denmark Macau* Tortola (BVI) * 
Djibouti* Malaysia Trinidad & Tobago 
Dominican Republic Malta* Tunisia* 

Egypt Mauritius* Turkey 

Faroe Islands* Mexico UAE 

Finland Mozambique* US Virgin Islands 
France Nth. Antilles* USSR 

French Antilles Netherlands United Kingdom 
French Guiana New Caledonia* United States 
French Polynesia* New Zealand Uruguay 

Gabon Northern Marianas Vanuatu* 
Gambia Norway Yugoslavia* 
Germany Zimbabwe 
Greece 


* Information will be available on the next update 


Gl 
= 


BASIC GLOBAL CONNECTION SERVICE providers connect their networks to BT TYMN 
exclusively via X.75 protocol gateways. The CCITT recommendation X.75 is 

closely related to the better known CCITT X.25 recommendation and provides a 
reliable communication channel for interworking between Public Data Networks. 


As a supplier of network technology to US IRC’s and foreign carriers for more 
than 10 years, BIT TYMNET has a wealth of experience with the X.75 standard and 
actively participates in its development. BT TYMNET X.75 software has evolved 
into a sophisticated product providing numerous advanced features not found in 
other X.75 implementations. BT TYMNET maintains and supports more X.75 gateway 
links than any other network in the world. 
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All of BT TYMNET’s X.75 gateways are supported by BT TYMNET’s International 


Network Services 


to provide a uniform 


network. 


(INS) group which ensures that all 
interface to BT TYMNET regardless of the origination 


the gateways are configured 


Note: TYMNET GLOBAL NETWO 


other DNICs listed 


E. Summary of Global Network Services By Country 


in the table below are the DNICs of the 


GLOBAL CONNECTION (EGC) and BASIC GLOBAL CONNECTION (BGC) 
providers. 

COUNTRY TGN DNIC/Network >> EGC BGC 
>> 

Alaska 3135/Alascom >> Xx 
>> 

Antigua 3443/Aganet >> x 
>> 

Argentina 7220/ARPAC >> Xx 
>> 

Argentina 7222/ARPAC >> Xx 
>> 

Australia xX BT TYMNET >> 
>> 

Australia 5052/AUSPAC >> Xx 
Se 

Australia 5053/MIDAS >> Xx 
>> 

Austria 2322 /DATEX-P >> xX 
>> 

Austria 2329/RADIO AUST >> Xx 
>> 

Bahamas 3640/BaTelCo >> xX 
>> 

Bahrain 4263/BAHNET >> Xx 
>> 

Barbados 3423/IDAS >> Xx 
>> 

Belgium xX BT TYMNET >> 
>> 

Belgium 2062/DCS >> x 
>> 

Belgium 206/DCS >> x 
>> 

Belgium 2069/DCS >> x 
>> 

Bermuda 3503/Bermudanet >> Xx 
SS 

Brazil 7240/Interdata >> Xx 
>> 

Brazil 7241/Renpac >> x 
>> 

Cameroun 6261/Campac >> x 
>> 

Canada Xx BT TYMNET >> 
>> 

Canada 3020/Datapac >> x 
>> 

Canada 3025/Globedat >> Xx 
>> 

Canada 3028/CNCP-PACKET>> 

Network >> xX 

>> 

Canada 3029/CNCP-INFO >> 

SWITCH >> xX 


RK (TGN) use BT TYMNET’s assigned DNIC of 3106. The 


ENHANC 


ED 


service 
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>> 
Cayman Islands 3463/IDAS >> 
>> 
Chile 3104/Entel]l >> 
>> 
Chile 7302/Entel >> 
>> 
Chile 7303/Chile-PAC >> 
>> 
Chile 7305/VTR >> 
>> 
China 4600/PTELCOM >> 
>> 
China 4602/CHINAPAK >> 
>> 
Columbia 7320/DAPAQ >> 
>> 
Columbia 7322/COLDAPAQ >> 
>> 
Costa Rica 7122/RACSAPAC >> 
>> 
Costa Rica 7129/RACSAPAC >> 
>> 
Cyprus 2802/Cytapac >> 
>> 
Cyprus 2803/Cytapac >> 
>> 
Cyprus 2808/Cytapac >> 
>> 
Cyprus 2809/Cytapac >> 
>> 
Denmark BT TYMNET >> 
>> 
Denmark 2382/Datapak >> 
>> 
Denmark 2383/Datapak >> 
>> 
Djibouti 6328/Dijipac >> 
>> 
Dominican Rep 3700/UDTS-I >> 
>> 
Egypt 6020/ARENTO >> 
>> 
Egypt 6023/EGYPTNET >> 
>> 
Faroe Islands 2881/Faroepac >> 
>> 
Finland 2442/Datapak >> 
>> 
France BT TYMNET >> 
>> 
France 2080/Transpac >> 
>> 
France 2081/NTI >> 
>> 
Fr Antillies 3400/Dompac >> 
>> 
Fr Guiana 7420/Dompac >> 
>> 
Fr. Polynesia 5470/Tompac >> 
>> 
Gabon 6282/Gabonpac >> 
>> 
Germany F.R BT TYMNET >> 
>> 
Germany F.R 2624/DATEX-P >> 
>> 
Greece 2022/Helpak >> 
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>> 

Greece 2023/Hellaspac >> 
>> 

Greenland 2901/KANUPAX >> 
>> 

Guadeloupe 3441/ >> 
>> 

Guam 5351/PCINET >> 
>> 

Guatemala 7043/GAUTEL >> 
>> 

Honduras 7080/HONDUTEL >> 
>> 

Hong Kong 4542/INTELPAK >> 
SS 

Hong Kong 4545/DATAPAK >> 
>> 

Hong Kong 4546/DATAPAC >> 
>> 

Hungary 2160/NEDEX >> 
>> 

Hungary 2161/DATEX >> 
>> 

Iceland 2740/Icepak >> 
>> 

India 4042/GPSS >> 
>> 

Indonesia 5101/SKDP >> 
>> 

Ireland 2724/EBirpac >> 
>> 

Israel 4251/Isranet >> 
>> 

Italy BT TYMNET >> 
>> 

Italy 2222/Darbo-Ital >> 
SS 

Italy 2227/Italcable >> 
>> 

Ivory Coast 6122/SYTRANPAC >> 
>> 

Jamaica 3380/Jamintel >> 
>> 

Japan 4400/Global VAN >> 
>> 

Japan 4404/JAIS >> 
>> 

Japan 4406/NIS- >> 
BT TYMNET >> 

>> 

Japan 4407/ >> 
>> 

Japan 4401/NTT DDX >> 
>> 

Japan 4408/Venus-P >> 
>> 

Japan 4410/NI+CI >> 
>> 

Japan 4411/K-NET >> 
>> 

Korea Rep 4501/DACOM-NE >> 
>> 

Kuwait 4190/ >> 
>> 

Kuwait 4263/KUPAC >> 
>> 

Lebanon 4155/RADUS >> 


>> 
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Luxembourg 2704/Luxpac-X.25>> 
>> 

Luxembourg 2709/Luxpac-Pad >> 
>> 

Macau 4550/Macoupac >> 
>> 

Madagascar 6360/ >> 
>> 

Malaysia 5021/Maynet >> 
>> 

Malta 2782/Maltapac >> 
>> 

Mauritius 6170/MauriData >> 
>> 

Mauritius 6171/MauriData >> 
>> 

Mexico 3340/TELEPAC >> 
>> 

Morocco >> 
>> 

Mozambique 6435/ >> 
>> 

Namibia 6490/Swanet >> 
>> 

Niger 6142/ >> 
>> 

Netherlands X BT TYMNET >> 
>> 

Netherlands 2041/Datanet-1 >> 
>> 

Netherlands 2044/DABAS >> 
>> 

Netherlands 2049/Datanet-1l >> 
Memocom >> 

>> 

N. Antilles 3620/LANDSRAIDO >> 
>> 

N. Marianas 5351/PCInet >> 
>> 

New Caledonia 5460/Tompac >> 
>> 

New Zealand Xx 3106/BT TYMNET >> 
>> 

New Zealand 5301/Pacnet >> 
>> 

Norway 2422/Datapak >> 
>> 

Panama 7141/INTEL >> 
>> 

Panama 7142/INTELPAQ >> 
>> 

Peru 3104/IMPACS >> 
>> 

Peru 7160/ENTEL >> 
>> 

Philippines 5152/Philcom >> 
>> 

Philippines 5154/GMCR >> 
>> 

Philippines 5156/ETPI >> 
>> 

Philippines 5151/CAPWIRE >> 
>> 

Polynesia 5470/Tompac >> 
>> 

Portugal 2680/Telepac >> 
>> 

Portugal 2682/CPRM >> 
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>> 
Puerto Rico 3300/WorldCom >> 
>> 
Puerto Rico 3301/PRTC >> 
>> 
Qatar 4271/DOHPAC >> 
>> 
Reunion 6470/Dompac >> 
>> 
San Marino 2922/X NET SMR >> 
>> 
Saudi Arabia 4201/Alwaseet >> 
>> 
Saudi Arabia 4263/Bahnet >> 
SS 
Senegal 6081/Serpac >> 
>> 
Singapore 5250/ >> 
>> 
Singapore 5252/Telepac >> 
>> 
South Africa 6550/Saponet >> 
>> 
South Africa 6559/Saponet >> 
>> 
Spain BT TYMNET >> 
>> 
Spain 2141/TIDA >> 
>> 
Spain 2145/Iberpac >> 
>> 
Sweden BT TYMNET >> 
>> 
Sweden 2401/Datapak >> 
>> 
Sweden 2402/Datapak >> 
>> 
Sweden 2403/Datapak >> 
>> 
Switzerland BT TYMNET >> 
>> 
Switzerland 2284/Telepac >> 
>> 
Taiwan 4877/1TA >> 
>> 
Taiwan 4872/PACNET >> 
>> 
Taiwan 4873/DCI Telepac>> 
>> 
Thailand 5200/IDAR >> 
>> 
Thailand 5201/Cateng >> 
>> 
Tortola, BVI 3483/ >> 
>> 
Trinidad 3740/Textel >> 
>> 
Trinidad 3745/Datanett >> 
>> 
Tunisia 6050/RED25 >> 
>> 
Turkey 2860/ >> 
>> 
Turkey 2862/I1GX >> 
>> 
Turkey 2863/Turpac >> 
>> 
Turks BWI 3763/ >> 
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>> 

UAE 4241/ >> x 
>> 

UAE 3104/IMPACS >> x 
>> 

UAE 4243 /EMDAN >> x 
>> 

U. Kingdom Xx BT TYMNET >> 
>> 

U. Kingdom 2350/Mercury >> x 
>> 

U. Kingdom 2351/Mercury >> x 
>> 

U. Kingdom 2341/BTI IPSS >> x 
>> 

U. Kingdom 2355/JAIS-Japan >> x 
>> 

U. Kingdom 2342/BT PSS >> Xx 
>> 

U. Kingdom 2352/Hull >> x 
>> 

United States x 3106/BT TYMNET >> 
>> 

Uruguay 7482/Antel >> Xx 
>> 

USSR 2502/Tasnet >> x 
>> 

U.S. Virgin I 3320/UDTS-I >> Xx 
>> 

Vanuatu 5410/Viapac >> x 
>> 

Yugoslavia 2201/Yupac >> x 
>> 

Zimbabwe 6482/Zimnet >> x 


F. Terminal Identifiers 
A terminal identifier indicates to the network the characteristics of your 
terminal. Most terminals can use the "A" terminal identifier. However, if 
your terminal requires a carriage return delay, for example, then the "I" 
or the "E" identifier should be used. 


At 'please type your terminal identifier’ pleas nter: 


for PC’s and CRT terminals (SAVE parity) 

for 300 baud Impact Printer Terminals 

for Thermal Printer Terminals like the SILENT 700 series 
for BETA transaction terminals 

the GE Terminet at 1200 baud 

for 300 baud Thermal Printer Terminals 

for EVEN/ODD parity terminals (future implementation) 
for MARK/SPACE parity terminals (BBS access) 

for 300 baud Transaction terminals 


KORH@ATHAD 
° 
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G. Login Options 
At the ’please log in:’ prompt the user can specify control characters to set 
the network to the needs of the user. For example when you are connected to a 
database and the data is coming in to fast you can backpressure the data by 
typing *S. The network however will only react on this command if you 
specified *R at the logon step. 


> 
GWA UVH TG 


“V 


.txt 
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control E Enter Full Duplex mode (future implementation) 
control H Enter Half Duplex mode - disable echo!! 
control I Build optimal circuit for Interactive traffic 
control P Force EVEN Parity 
control R Enable host backpressure X-on X-off 
control U Force terminal data to uppercase 
control V Build optimal circuit for Volume traffic 
control W Erase login up to last terminator 
control X Enable terminal backpressure X-on X-off 
control 2 Disconnect/Logoff 

scap Discard login and get NEW please log in prompt 


break 


Switch to CCITT X.3 X.28 X.29 PAD (selected nodes) 
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==Phrack Inc.== 


Volume Four, Issue Forty, File 9 of 14 


BT Tymnet 
British Telecom 


Part 2 of 3 
Presented by Toucan Jones 


August 1, 1992 


Welcome Back to Tymnet! 


A. B ymnet Access Location Index 

B. BT-GNS Access Within Regional Bell Operating Companies 
Bell Atlantic 

BellSouth 
Pacific Bell 
Southwestern Bell 
Southern New England Telephone 

C. Database or Timesharing Companies on Tymnet 

D. Service Classifications For Database or Timesharing Companies Using Tymnet 
E. Summary of Global Network Services By Country 
F 

G 


OB WNER 


Terminal Identifiers 
Login Options 


H. BTI-GNS Worldwide Asynchronus Outdial Service 


PART 3 
I. BT-GNS Worldwide Access Sorted By Node 


H. BTI-GNS Worldwide Asynchronus Outdial Service 


DIALUP ACCESS M 
— OUTDIAL - PROV 100’s bps N 
HOST CITY ST CNTRY DENS 3 12 24 96 AREA CODE P COMMENTS 
7651 Anniston AL USA LOW B. B <G 205 Y 
4101 Birmingham AL USA HIGH BB C 205 Y 
2517 Dothan AL USA LOW BBC 205 Y 
5641 Florence AL USA LOW BiB: 3G 205 ¥ 
8287 Gadsden AL USA LOW BB C 205 ng 
T37 Huntsville AL USA MED BB 2 205 ne 
8829 Mobile AL USA MED BB Cc 205 Y 
3245 Montgomery AL USA LOW BB C 205 Y 
2439 Northport AL USA LOW By Be 205 Y 
1751 Opelika AL USA LOW BB C 205 Y 
2439 Tuscaloosa/Northport AL USA LOW BB C 205 ¥ 
15360 Fayetteville AR USA LOW BB C 501 Y 
1297 Ft. Smith AR USA LOW BiB» 501 Y 
2725 Hot Springs AR USA LOW BB C 501 Y 
2794 Jonesboro AR USA LOW BB C 501 ¥ 
10690 Little Rock AR USA MED BB Cc 501 Y 
10690 Little Rock AR USA ME Bo By +¢ 501 ¥ 
7380 Pine bluff AR USA LOW BB C 501 Y 
15360 Springdale/Fayettevl AR USA LOW BB C 501 Y 
6112 Flagstaff AZ USA LOW Be Be ve 602 Y 
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9532 
9532 
9532 
9532 
3232 
3232 
3530 
8963 
2940 
2940 
9184 
9184 
4457 
2940 
2940 
3664 
9182 
8963 
9206 
2841 
3486 
9206 
7859 
7801 
6294 
9202 
9202 
5415 
4309 
7276 
4309 
06824 
2940 
2940 
9203 
09203 
4304 
981 
03513 
3513 
71399 
3996 
3996 
2841 
8963 
3173 
3173 
3173 
3173 
9184 
9184 
5991 
9205 
6616 
6450 
6450 
6450 
3173 
3173 
3173 
3173 
9203 
9203 
9203 
03501 
14085 
2120 
10401 
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Mesa/Phoenix 
Mesa/Phoenix 

Phoenix 

Phoenix 

Tucson 

Tucson 

Yuma 
Alameda/Oakland 
Alhambra 

Alhambra 
Anaheim/Newprt Beach 
Anaheim/Newprt Beach 
Antioch 
Arcadia/Alhambra 
Arcadia/Alhambra 
Bakersfield 

Belmont /Redwood City 
Berkeley/Oakland 
Beverly Hills/Shr Ok 
Burbank 
Burlingame/So. S.F. 
Canoga Park/Shrm Oak 
Cathedral City 

Chico 

Colton 
Concord/Walnut Creek 
Concord/Walnut Creek 
Corona 
Covina/Diamond Bar 
Davis 

Diamond Bar 

1 Centro 
Monte/Alhambra 
Monte/Alhambra 
Segundo 

Segundo 
scondido/Vista 
Eureka 

Fairfield 

Fairfield 

Fremont 

Fresno 

Fresno 
Glendale/Burbank 
Hayward/Oakland 
Inglewood/Vernon 
Inglewood/Vernon 
Inglewood/Vernon 
Inglewood/Vernon 
Irvine/Newport Beach 
Irvine/Newport Beach 
Lancaster 

Long Beach 


2 a 63 2 


os Alamos/St. Maria 
Los Altos/San Jose 
Los Altos/San Jose 
Los Altos/San Jose 


Los Angeles/Vernon 
Los Angeles/Vernon 
Los Angeles/Vernon 
Los Angeles/Vernon 

El Segundo 
Mar Vista/El Segundo 
MarinaDelRey/El Sgnd 
Marysville 
Merced 
Modesto 
Monterey 


43:39 2017 
AZ USA H 
AZ USA H 
AZ USA 4H 
AZ USA 4H 
AZ USA M 
AZ USA M 
AZ USA L 
CA USA H 
CA USA M 
CA USA M 
CA USA H 
CA USA 4H 
CA USA L 
CA USA M 
CA USA M 
CA USA L 
CA USA H 
CA USA H 
CA USA M 
CA USA L 
CA USA L 
CA USA M 
CA USA L 
CA USA L 
CA USA M 
CA USA L 
CA USA L 
CA USA L 
CA USA M 
CA USA L 
CA USA M 
CA USA L 
CA USA M 
CA USA M 
CA USA M 
CA USA M 
CA USA M 
CA USA L 
CA USA L 
CA USA L 
CA USA M 
CA USA L 
CA USA L 
CA USA L 
CA USA H 
CA USA H 
CA USA H 
CA USA 4H 
CA USA H 
CA USA H 
CA USA H 
CA USA L 
CA USA M 
CA USA L 
CA USA H 
CA USA 

CA USA H 
CA USA H 
CA USA H 
CA USA H 
CA USA H 
CA USA M 
CA USA M 
CA USA M 
CA USA L 
CA USA L 
CA USA L 
CA USA L 


SO SO 


(00a UO UOC SMU ON UUM UC MOOR UCMEUC MOC MUSEU CMEUCMEOCMEUUREUCMEOCMEUC MEU CMEUCMEUC MEU CMEC UMEUCMEOU MEU CMEUC MECC MEUCMEUUREUCMEOC ME UUMEUCEOC ME UCMEUUMEUCHEUCMEUUMEUCMEOCMEUCMEUCMEOC ME UC MEU UMEUCMEOC MECC MEU MEOC MECC MEU CME UUMEUCHEUCMEUUMEUCMEOU MEU CME UUREOU MEU CRE UURIUCREUS) 


(00 /a Uo UCC CUO UU RRU CMCC MECC MECC MECC ME UC EU CMEUCMEOCMEUCMEUCMEOC MECC MEU CME UUREUCMEUCMEUCMEUCMEOCMEUOMEOCMEOU MEU CME UUREUCMEOC ME UUMEUCMEOCMEUCMEUUREUCHEU CME UUREUCMEOC MECC MEU CMEOCMEUCMEUUMEUCMEOCMEUU MEU MECC MECC MEU CME UUMEUCHEUCMEUCMEUCMEOU MEU CMEUUREUU MEU CME UUMEUCMEOC MIEN \~) 
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10401 Monterey 

Moorpark 

Napa 

Newport Beach 
Newport Beach 
Norwalk/Long Beach 
Oakland 
Ontario/Diamond Bar 
Oxnard/Port Hueneme 


5134 
13891 
9184 
9184 
9205 
8963 
4309 
4112 
9202 
9202 
7859 
9182 
2940 
2940 
9202 
9202 
4309 
4112 
5416 
4972 
9182 
6294 
9179 
3655 
6294 
4447 
9183 
9183 
9206 
9533 
95:33 
95:33 
6450 
6450 
6450 
2979 
3486 
9205 
8094 
9184 
9184 
6295 
6450 
6450 
6450 
3182 
6116 
9203 
4111 
9206 
3486 
3208 
6450 
6450 
6450 
14338 
3830 
9206 
4112 
3173 
3.173 
3173 
31.73 
3598 
4304 
4309 
9202 


Pa 
Pa 


Pacheco/Walnut Creek 
Pacheco/Walnut Creek 
lm Sprngs/Cath Cty 
lo Alto/Redwd City 
Pasadena/Alhambra 
Pasadena/Alhambra 
Pleasnthill/Walnt Ck 
Pleasnthill/Walnt Ck 
Pomona/Diamond Bar 
Port Hueneme 


Poway 

Redding 

Redwood City 
Riverside/Colton 
Sacramento 

Salinas 

San Bernadino/Colton 
San Clemente 

San Diego 

San Diego 

San Fernando/Shr Oak 
San Francisco 

San Francisco 

San Francisco 

San Jose 

San Jose 

San Jose 

San Luis Obispo 

San Mateo/So. S.F. 
San Pedro/Long Beach 
San Rafael 


Santa Ana/Newprt Bch 
Santa Ana/Newprt Bch 
Santa Barbara 

Santa Clara/San Jose 
Santa Clara/San Jose 
Santa Clara/San Jose 
Santa Cruz 

Santa Maria 

Santa Monica/El Sgnd 
Santa Rosa 

Sherman Oaks 

So. San Francisco 
Stockton 
Sunnyvale/San Jose 
Sunnyvale/San Jose 
Sunnyvale/San Jose 


Up 
Val 


land 


llejo 


Van Nuys/Sherman Oak 
Ventura/Port Hueneme 
Vernon 

Vernon 

Vernon 

Vernon 

Visalia 

Vista 
W.Covina/Diamond Bar 
Walnut Creek 


CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 


SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 
SA 


LOW 
LOW 
LOW 
HIGH 
HIGH 
MED 
HIGH 
MED 
MED 


I 
H 
9) 

I 


I I 
HH 
aa 

I I 


[00] Uo UU REO OOO UCU COC MECC MEUC MOC SUSIE UUMEUCMEOCMEUUMEUCMEOC MECC MEU CME UCMEUC MEU CME UCMEUCHEOU MEU CMEUC MECC MEU CME UUMEUCMEOCMEUUMEUCMEOU ME UCMEUUMEUCMEU CME UUMEUCMEOCMEUCMEUCMEOC ME UCMEUCMEUCMEOC MECC MIU MEOCMEUCMEUCMEUUMEUCHEUCMEUUMEUCMEOU MEU CME UUMIOU MEU CME UURIUCHEUS) 


[00 /a Uo UCC 0 UO URN U CROC RECO MECC MECC MECC MEU CREO CMEC ME UUMEUCMEOCMECC MEU CME UUMIUSMEUCMEUCMEUCMEOCMEUCMEUC MECC MEU CME UUREUCMEOC ME UUMEUCHEOU MEU CME UUMEUCHEUCMEUUREUCMEOCMEUCMEUCMEOCMEUCMEUCMEUCMEOCMEUU MEU MEOC MECC MEU CME UUMEUCHEUUMEUCMEUCMEOU MEU UME UUREUUMEUUMEUUMEUCMEOC MEE C') 
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British Telecom 


Part 3 of 3 
Presented by Toucan Jones 


August 1, 


1992 


Welcome Back to Tymnet Again! 


ymnet Access Location Index 


Southwestern Bell 


Southern New 
atabase or 1 


Eng] 


and Telephone 


[-GNS Access Within Regional Bell Operating Companies 


Timesharing Companies on Tymnet 
Service Classifications For Database or Timesharing Companies Using Tymnet 


ummary of Global Network Services By Country 


ogin Options 
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Terminal Identifiers 


T-GNS Worldwide Access Sorted By Node 


T-GNS Worldwide Asynchronus Outdial Service 


I. BI-GNS Worldwide Access Sorted By Node 


DIALUP ACCESS M 
PROV 100’S BPS N 
NODE CITY ST CNTRY DENS 3 12 24 96 ACCESS NO. P COMMENTS 
Porto Alegre BRA BGC € (011) 15331 N BGC Access 
Porto Alegro BRA BGC GC (011) 15311 N BGC Access 
Cartago CRI BGC Ge 51-2000 N BGC Access 
C. Quesada CRI BGC Cre 46-2000 N BGC Access 
Heredia CRI BGC CC 38-2000 N BGC Access 
Kuwait City KUW BGC Cc 143 N BGC Access 
Rio BRA BGC c (021) 2538153 N BGC Access 
Cairo EGY BGC Cc (2) 3907102 N BGC Access 
Sao Paolo BRA BGC Cc (011) 1531 N BGC Access 
Antofaganta CHI BGC EE (083)251634 Y BGC Access 
Iguigue CHI BGC Ge (051) 27907 Y BGC Access 
La Serena CHI BGC Cee (051)215751 Y BGC Access 
Punta Arenas CHI BGC Giere (061) 28018 Y BGC Access 
Santiago CHI BGC C.A€ (02) 6987788 Y BGC Access 
Talca CHI BGC Cu€ (041)234814 Y BGC Access 
Temuco CHI BGC Cu-€ (045)231476 Y BGC Access 
Valdivia CHI BGC C.2€ (061) 28018 Y BGC Access 
Valparaiso CHI BGC ‘ome (032)258052 Y BGC Access 
Beijing CNA BGC € 3014443 N BGC Access 
Alajvela CRI BGC CHG 41-2000 N BGC Access 
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Liberia CRI BGC Ce-€ 66-2000 N BGC Access 
Cairo EGY BGC Cc (2) 390-9111 N BGC Access 
Orste CRI BGC GAc 20-2000 N BGC Access 
Limon CRI BGC Ce 58-2000 N BGC Access 
Puntapbnas CRI BGC Gee 61-2000 N BGC Access 
San Jose CRI BGC OME C: 57-2000 N BGC Access 
S.Isidro CRI BGC CG 71-2000 N BGC Access 
Cairo EGY BGC Cc (2) 390-7203 N BGC Access 
Bombay IND BGC G (22) 275-916 N BGC Access 
Bombay IND BGC Cc (22) 275-847 N BGC Access 
Adak AK USA ALAS BB C 907/592-2557 N 

Anchorage AK USA ALAS c 907/258-6607 Y 

Anchorage AK USA ALAS BB 907/258-7222 N 

Barrow AK USA ALAS BB 907/852-2425 N Stat Mux 
Bethel AK USA ALAS BB 907/543-2411 N Stat Mux 
Cantwell AK USA ALAS BB C 907/768-2700 N 

Cordova AK USA ALAS BB 907/424-3744 N 

Craig AK USA ALAS BB C 907/826-2948 N 

Dead horse AK USA ALAS BB 907/659-2777 N 

Delta Junction AK USA ALAS BB 907/895-5070 N 

Dillingham AK USA ALAS BB 907/842-2688 N Stat Mux 
Dutch Harbor AK USA ALAS BB C 907/581-1820 N 

Fairbanks AK USA ALAS C 907/452-5848 Y 

Fairbanks AK USA ALAS B 907/456-3282 N 

Glennallen AK USA ALAS BB 907/822-5231 N 

Haines AK USA ALAS B 907/766-2171 N 

Healy AK USA ALAS BB C 907/683-1350 N 

Homer AK USA ALAS B 907/235-5239 N 

Juneau AK USA ALAS C 907/789-1976 Y 

Juneau AK USA ALAS BB 907/789-7009 N 

Kenai AK USA ALAS BB 907/262-1990 N 

Ketchikan AK USA ALAS BB 907/225-1871 N Stat Mux 
King Salmon AK USA ALAS BB 907/246-3049 N 

Kodiak AK USA ALAS BB 907/486-4061 N Stat Mux 
Kotzebue AK USA ALAS BB 907/442-2602 N 

Mcgrath AK USA ALAS BB 907/524-3256 N Stat Mux 
Menana AK USA ALAS B 907/832-5214 N 

Nome AK USA ALAS BB 907/443-2256 N Stat Mux 
Northway AK USA ALAS BB 907/778-2301 N Stat Mux 
Palmer/Wasilla AK USA ALAS BB 907/745-0200 N 

Petersburg AK USA ALAS B 907/772-3878 N 

Prudhoe Bay AK USA ALAS BB 907/659-2777 N 

Seward AK USA ALAS BB 907/224-3126 N Stat Mux 
Sitka AK USA ALAS BB 907/747-5887 N Stat Mux 
Skagway AK USA ALAS B 907/983-2170 N 
Soldotna/Kenai AK USA ALAS BB 907/262-1990 N 

St. Paul AK USA ALAS BB 907/546-2320 N Stat Mux 
Tanana AK USA ALAS BB 907/366-7167 N Stat Mux 
Tok AK USA ALAS B 907/883-4747 N 
Unalaska/Dutch Hbr. AK USA ALAS BB C 907/581-1820 N 

Valdez AK USA ALAS BB 907/835-4987 N Stat Mux 
Wasilla AK USA ALAS BB 907/745-0200 N 

Whittier AK USA ALAS BB 907/472-2467 N Stat Mux 
Wrangell AK USA ALAS B 907/874-2394 N 

Yakutat AK USA ALAS BB 907/784-3453 N Stat Mux 
Kuwait City KUW BGC € 142 N BGC Access 
Kuwait City KUW BGC Cc 141 N BGC Access 
Kuala Lumpur MAL BGC C (30) 2328800 N BGC Access 
Kuala Lumpur MAL BGC G (30) 2328855 N BGC Access 
Penang MAL BGC C (04) 375588 N BGC Access 
Penang MAL BGC € (04) 360088 N BGC Access 
Kota Kinabalu MAL BGC a (088) 218800 N BGC Access 
Kota Kinabalu MAL BGC CG (088) 218855 N BGC Access 
Petaling MAL BGC re (03) 7926600 N BGC Access 
Ipoh MAL BGC Cc (05) 548533 N BGC Access 
Abu Dhabi UAE BGC Cc (4) 400-2763 N BGC Access 
Surabaya IND BGC c 21242 N BGC Access 
Jakarta IND BGC Cc 3805476 N BGC Access 
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Cambridge/Boston MA 
Elgin IL 
Burlington VT 
Albuquerque NM 
Eau Claire WI 
New York NY 
Ormond Beach FL 
| Seattle WA 
Bellevue/Seattl WA 
Newark NJ 
Elizabeth/Newark NJ 
Jersey City/Newark NJ 
Union/Newark NJ 
Knoxville TN 
Norristown PA 
Grand Junction CO 
Baltimore MD 
Bloomfield Cr 
Hartford/Bloomfield CT 
Mesa/Phoenix AZ 
Phoenix AZ 
Champaign/Urbana IL 
Urbana IL 
Lima OH 
Minneapolis MN 
St. Paul/Minneapolis MN 
Hattiesburg MS 
Birmingham 
Aurora/Denver CO 
Boulder/Denver ole) 
Denver CO 
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Chattanooga TN 
Williamsburg VA 
Brookfield WI 
Milwaukee/Brookfield WI 
Burbank CA 
Glendale/Burbank CA 
Texarkana TX 
KingofPrussa/Norstwn PA 
Valley Forge/Norstwn PA 
Dallas TX 
Downrs Grove/Gln Eln IIL 
Glen Ellyn IL 
Wheaton/Glen Ellyn IL 
Paris 
White Plains NY 
Alkmaar 
Bellevue/Seattl WA 
Seattle WA 
Nashville TN 
Jacksonville FL 
Washington/Fairfax DC 
Bethesda/Fairfax MD 
Alexandria/Fairfax VA 
Arlington/Fairfax VA 
Fairfax VA 
Washington/Fairfax DC 
Bethesda/Fairfax MD 
Alexandria/Fairfax VA 
Arlington/Fairfax VA 
Fairfax VA 
Tyler TX 
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203/242-7140 
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004/229-6786 
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Warwick/Providence 
San Diego 
Jackson 
Tupelo 

St. Laurent 
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San Jose 
Kingsport 
Houston 

La Crosse 
Baton Rouge 
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Jackson 

Stamford 

San Antonio 

Tucson 

Wheeling 

Dallas 
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303/830-9032 
201/824-1212 
201/824-1212 
201/824-1212 
201/824-1212 
707/421-0106 
919/549-8952 
919/549-8952 
805/945-4962 
508/526-1506 
903/868-0089 
714/756-8341 
14/756-8341 
14/756-8341 
4/756-8341 
9/375-3367 
3/924-7090 
14/752-1493 
14/752-1493 
14/752-1493 
14/752-1493 
03/965-0000 
14/370-1200 
14/370-1200 
4/370-1200 
1/751-8030 
401/273-0200 
1/751-8030 
1/273-0200 
1/751-8030 
1/273-0200 
619/296-8747 
517/788-9191 
601/841-0090 
514/747-2996 
514/747-2996 
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15/378-5746 
713/496-1332 
608/784-9099 
504/924-5102 
801/364-0780 
601/355-9741 
203/324-2297 
512/225-8002 
602/297-2239 
304/233-7676 
214/638-8888 
708/844-0700 
708/844-0700 
800/#tt-tttt 
15/889-4044 
15/889-5790 
07/387-7313 
14/456-8501 
19/829-0536 
232) 234467 
08/522-3624 
18/234-8255 
117/763-6481 
117/763-6481 
12/922-6571 
14/432-3064 
09/394-1900 
199/422-2581 
13/424-8024 
12/464-8181 
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03661 Charleston WV USA LOW BB C 304/345-9575 Y 

03662 Allentown/Bethlehem PA USA MED BuB- © 215/865-6978 Y 

03662 Bethlehem PA USA MED BB C 215/865-6978 Y 

03663 Mesa/Phoenix AZ USA HIGH C 602/258-4528 Y 

03663 Phoenix AZ USA HIGH C 602/258-4528 Y 

03664 Phoenix AZ USA HIGH Cc 602/257-0629 N TYM-X25 
03664 Phoenix AZ USA HIGH Cc 602/257-0736 N TYM-X25 
03666 Lansing MI USA MED BB 517/482-5721 N 

03673 Carson City NV USA MED BB C 702/885-8411 Y 

03673 Reno/Carson City NV USA MED BB C 702/885-8411 Y 

03675 Worcester MA USA LOW BB C 508/791-9000 Y 

03677 Joplin MO USA LOW BB Cc 417/781-8718 Y 

03704 Niagara Falls NY USA LOW BB C 716/285-2561 Y 

03705 Albany NY USA MED BB 518/458-8300 N 

03705 Schenectady/Albany NY USA MED BB 518/458-8300 N 

03706 San Francisco CA USA HIGH BB 415/974-1300 N 

03707 Philadelphia PA USA HIGH C 215/629-0567 Y 

03712 Ottomwa IA USA LOW BB C 515/682-0857 Y 

03720 Winston-Salem NC USA MED BB C 919/765-1221 Y 

03725 Los Altos/San Jose CA USA HIGH C 408/432-0804 Y 

03725 San Jose CA USA HIGH C 408/432-0804 Y 

03725 Santa Clara/San Jose CA USA HIGH C 408/432-0804 Y 

03725 Sunnyvale/San Jose CA USA HIGH C 408/432-0804 Y 

03726 Billings MT USA LOW BB © 406/252-4880 Y 

03731 Shreveport LA USA LOW BB C 318/688-5840 Y 

03733 Brussels BEL E Ere ac (2) 725-5060 Y 

03733 Brussels BEL El es 02-7255015 N HSA 
03737 Clearwater FL USA MED C 813/443-4515 Y 

03752 Rosemont IL USA HIGH BB C 708/698-9800 Y 

03774 Port Angeles WA USA LOW BB C 206/452-6800 Y 

03775 Newark OH USA LOW BB C 614/345-8953 Y 

04000 Longwood/Orlando FL USA MED BB 407/841-0020 N 

04000 Orlando FL USA MED BB 407/841-0020 N 

04003 Agana Heights GUM * Ce 671/477-2222 N 

04003 Guatemala City GIM 2 B (2) 345-999 N TYMUSA 
04003 Guatemala City GIM 2 B (2) 345-599 N TYMUSA 
04003 All Cities HND 2 BB 320-544 N TYMUSA 
04003 Afula ISR 3 BB C (6) 596658 N TYMUSA 
04003 Ashdod TSR. 3 BwB* VE (8) 542999 N TYMUSA 
04003 Bezegq ISR 3 BB Cc (57) 36029 N TYMUSA 
04003 Bilat ISR 3 BB C (59). 75147 N TYMUSA 
04003 Hadera ISR 3 BB C (6) 332409 N TYMUSA 
04003 Haifa ISR 3 BB °¢ (4) 525421 N TYMUSA 
04003 Haifa ISR 3 BB C (4) 673235 N TYMUSA 
04003 Haifa ISR 3 BB C (4) 674203 N TYMUSA 
04003 Haifa TSR. +33 BB: WC (4) 674230 N TYMUSA 
04003 Herzeliya ISR 3 BB 3S (52) 545251 N TYMUSA 
04003 Jerusalem ISR 3 BB C (2) 242675 N TYMUSA 
04003 Jerusalem ISR 3 BB C (2) 246363 N TYMUSA 
04003 Jerusalem ISR 3 BoB + (2) 248551 N TYMUSA 
04003 Jerusalem ISR 3 BB C (2) 814396 N TYMUSA 
04003 Nahariya ISR 3 BB C (4) 825393 N TYMUSA 
04003 Netanya ISR 3 BB? “<¢ (53) 348588 N TYMUSA 
04003 Rechovot ISR 3 BB 3 (8) 469799 N TYMUSA 
04003 Tel Aviv ESR: +3 BB C (3) 203435 N TYMUSA 
04003 Tel Aviv ISR 3 BB Cc (3) 546-3837 N TYMUSA 
04003 Tel Aviv ISR 3 BB C (3) 751-2504 N TYMUSA 
04003 Tel Aviv ISR 3 BB C (3) 751-3799 N TYMUSA 
04003 Tel Aviv ISR 3 BB C (3) 752-0110 N TYMUSA 
04003 Tiberias ISR 3 BB C (6) 790274 N TYMUSA 
04003 Tzfat ISR 3 BiB “¢ (6) 973282 N TYMUSA 
04003 Al Cities JAM 2 BB 809/924-9915 N TYMUSA 
04003 Curacao NDA 3 Exe (9): 239251 N TYMUSA 
04003 Curacao & St. Martin NDA 3 Cre QO2Z51 N TYMUSA 
04003 Al Cities PAN 3 i: 636-727 N TYMUSA 
04003 A Cities PAN 3 BB 639-055 N TYMUSA 
04003 Manila PHL 2 BB (2) 815-1553 N TYMUSA 
04003 Manila PHL 2 BB (2) 815-1555 N TYMUSA 
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San Juan 
Alkobar 
Jeddah 
Jeddah 
Riyadh 
Riyadh 

All Cities 
All Cities 
Aberdeen 
Birmingham 
Bristol 
Cambridge 
Cardiff 
Chelmsford 
Edinburgh 
Exeter 
Glasgow 
Hastings 
Ipswich 
Kings Lynn 
Leamington 
Leeds 
Liverpool 
London 
Luton 
Manchester 
Newcastle 
Nottingham 
Oxford 
Plymouth 
Reading 
Ayr 

Belfast 
Benbecula 
Brechin 
Brecon 
Brighton 
Campbeltown 
Canterbury 
Carlisle 
Hempstead 


Mineola/Hempstead 


Salem 
Lubbock 
Brownsville 
Dallas 


Beverly Hills/Shr Ok 
Canoga Park/Shrm Oak 
San Fernando/Shr Oak 
Sherman Oaks 

Van Nuys/Sherman Oak 
West L.A./Shrmn Oaks 
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San Diego 
Norristown 


yaquez/Ponce 
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2) 817-1581 N TYMUSA 
2) 817-1791 N TYMUSA 
2) 817-1796 N TYMUSA 
2) 521-7901 N TYMUSA 
2) 817-8811 N TYMUSA 
2) 819-1009 N TYMUSA 
2) 819-1011 N TYMUSA 
2) 819-1550 N TYMUSA 
809/462-4213 N 
809/724-6070 N 
09/725-1882 N 
809/725-4343 N 
09/725-3501 N 
09/725-4702 N 
3) 8981025 N TYMUSA 
2) 6691377 N TYMUSA 
2) 6690708 N TYMUSA 
1) 4631038 N TYMUSA 
1) 4658803 N TYMUSA 
09/627-0854 N TYMUSA 
09/627-0855 N TYMUSA 
224) 210701 Y TYMUSA 
21) 633-3474 Y TYMUSA 
272) 211545 Y TYMUSA 
223) 460127 Y TYMUSA 
222) 344184 Y TYMUSA 
245) 491323 Y TYMUSA 
31) 313-2137 Y TYMUSA 
392) 421565 Y TYMUSA 
41)204-1722 Y TYMUSA 
424) 722788 Y TYMUSA 
473) 210212 Y TYMUSA 
553) 691090 Y TYMUSA 
926) 451419 Y TYMUSA 
532) 440024 Y TYMUSA 
51)255-0230 Y TYMUSA 
71) 490-2200 Y TYMUSA 
582) 481818 Y TYMUSA 
61) 834-5533 Y TYMUSA 
91) 261-6858 Y TYMUSA 
22?) 506005 Y TYMUSA 
865) 798949 Y TYMUSA 
752) 603302 Y TYMUSA 
734) 500722 Y TYMUSA 
292) 611822 Y TYMUSA 
232) 331284 Y TYMUSA 
870) 2657 Y TYMUSA 
356) 25782 Y TYMUSA 
874) 3151 Y TYMUSA 
273) 550046 Y TYMUSA 
586) 52298 Y TYMUSA 
227) 762950 Y TYMUSA 
12/333-2799 N 
16/485-7422 Y 
16/485-7422 Y 
03/370-4314 Y 
06/797-0765 Y 
12/548-1331 Y 
14/630-5516 Y 
18/789-9557 Y 
118/789-9557 Y 
18/789-9557 Y 
118/789-9557 Y 
118/789-9557 Y 
118/789-9557 Y 
13/965-4982 N TYM-X25 
199/296-3370 N 
OO/##t-tttt Y 


Concord 
Merced 


Redwood 


Huntsvil 


Wed Apr 26 09:43:39 2017 


Oklahoma City 
Belmont /Redwood City 
Palo Alto/Redwd City 


City 


Newark/Wilmington 
Wilmington 


e 


l Greenvil 


le 


White Pl 


Hibbing 


1 Los Ange 
| Vernon 
Inglewood/Vernon 

les/Vernon 


Vernon 
Quincy 


Los Ange 


Eindhoven 


lains 


| Florence 
Inglewood/Vernon 
les/Vernon 


Clarkesville 


Durham 
Spokane 


Peoria 
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Philadelphia 
Fort Pierce 


Riverside/Colton 
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03/389-0146 
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14/561-9103 
15/928-9544 
04/977-5661 
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03/370-4314 
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19/549-9025 
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Lewiston/Auburn ME 
London 
Naples FL 
Memphis TN 
Vancouver BC 
Dusseldorf 
Calgary AB 
El Paso TX 
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Buffalo NY 
Houston TX 
Amsterdam 
Grand Rapids MI 
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207/795-6013 
(81) 566-7260 
813/434-8080 
901/527-8122 
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713/496-1332 
2041290546 
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618/632-3993 
(71) 489-8571 
408/375-2644 
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517/484-5344 
803/254-7563 
803/271-9213 
205/460-2515 
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817/565-0552 
206/574-0427 
501/666-6886 
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Rockford IL 
Little Rock AR 
Alameda/Oakland CA 
Berkeley/Oakland CA 
Hayward/Oakland CA 
Oakland CA 
Oakridge TN 
Northport AL 
Tuscaloosa/Northport AL 
Augusta/Martinez GA 
Martinez GA 
Owensboro KY 
Toronto ON 
Toronto ON 
Midlothian/Richmond VA 
Richmond VA 
Ft. Lauderdale FL 
Ft. Lauderdale FL 
Hollywd/Ft. Laudrdle FI 
Hollywd/Ft. Laudrdle FI 
Pompno Bch/Fr. Ldrdl FIL 
Pompno Bch/Ft. Ldrdl FL 
Asheville NC 
London 

Stamford Cr 
Santa Barbara CA 
Santa Barbara CA 
New Orleans LA 
Modesto CA 
Marlborough MA 
Seattle WA 
Bellevue/Seattl WA 
Battle Creek MI 
Harrisonburg VA 
Groton MA 
Chicago IL 
Chicago IL 
Munich 

Clarksburg WV 
Salt Lake City UT 
Salt Lake City UT 
Salt Lake City UT 
Hazelwood MO 
St. Louis MO 
Bridgeton/St. Louis MO 
Tampa FL 
Tampa FL 
Rochester MN 
Georgetown DE 
Greensburg PA 
Latrobe/Greensburg PA 
Huntsville AL 
Alhambra CA 
Arcadia/Alhambra CA 
El Monte/Alhambra CA 
Pasadena/Alhambra CA 
Zurich 

Leeds 

Duluth MN 
Northfield IL 
Bristol 

Hamburg 

West Bend WI 
St. Cloud MN 
Victoria TX 
Portsmouth/Norfolk VA 
Virginia Bch/Norfolk VA 
Norfolk VA 


SA 
SA 
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SA 
SA 
SA 
SA 
SA 
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15/633-2080 
01/666-1224 
10/638-7904 
10/638-7904 
10/638-7904 
10/638-7904 
615/482-1466 
205/758-1116 
205/758-1116 
404/855-0442 
404/855-0442 
502/685-0959 
416/361-3028 
416/361-3383 
804/330-2673 
804/330-2673 
305/779-3445 
305/467-1870 
305/779-3445 
305/467-1870 

0 
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305/467-187 
305/779-344 
704/253-8945 
(81) 566-7260 
203/327-2974 
805/564-2354 
805/965-1612 
504/524-1738 
209/527-0150 
508/481-0026 
206/281-7141 
206/281-7141 
616/964-9303 
703/433-6333 
508/448-9361 
312/427-1506 
312/427-1453 
(89) 129-6081 
304/624-1451 
801/364-7605 
801/364-7439 
801/364-7451 
314/731-8283 
14/731-8283 
14/731-8283 
13/933-7095 
13/933-7303 
07/282-0830 
02/856-1788 
12/838-1920 
12/838-1920 
05/882-9199 
18/308-1800 
18/308-1800 
18/308-1800 
18/308-1800 
1) 837-0301 
532) 341838 
18/722-0655 
708/501-4536 
(272) 255392 
(40) 251-4037 
414/334-1755 
612/656-1280 
512/576-9200 
804/857-0148 
804/857-0148 
804/857-0148 
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Columbia MO 
Presque Isle ME 
New Haven CT 
Memphis TN 
Fayetteville NC 
St. Louis MO 
Bridgeton/St. Louis MO 
Nashville TN 
Belleville/O’Fallon IL 
Gary IN 
Hammond/Gary IN 
Highland/Gary IN 
| Gary IN 
Hammond/Gary IN 
Highland/Gary IN 
Rotterdam 
Rotterdam 
Rotterdam 
| Washington/Fairfax DC 
| Bethesda/Fairfax VA 
| Alexandria/Fairfax VA 
1 Arlington/Fairfax VA 
l Fairfax VA 
Lakeland FL 
Winterhaven/Lakeland FL 
Freeland MI 
Midland/Freeland MI 
Saginaw/Freeland MI 
Aurora/Denver CO 
Boulder/Denver CO 
Denver CO 
Bremen 
El Centro CA 
Fairfield CA 
Victorville CA 
Tallahassee FL 
Tallahassee FL 
Jacksonville FL 
Watertown NY 
Lancaster CA 
Maui HI 
Meriden Cr 
Middletown/Meriden CT 
Aiken SC 
London ON 
Honolulu HI 
Paducah KY 
Dover DE 
Marysville CA 
Great Falls MT 
Los Gatos CA 
Paris 
Birmingham AL 
Midland TX 
Odessa/Midland TX 
Zanesville L 
Bismark ND 
Houston TX 
Spokane WA 
Sarasota FL 
Goteborg 
Rochester MN 
Dallas TX 
Downrs Grove/Gln Eln IL 
Glen Ellyn IL 
Wheaton/Glen Ellyn IL 
Knoxville TN 
Alexandria/Fairfax VA 


USA LOW 
USA LOW 
USA MED 
USA MED 
USA LOW 
USA HIGH 
USA HIGH 
USA HIGH 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
NLD E 
NLD E 
NLD E 
USA HIGH 
USA HIGH 
USA HIGH 
USA HIGH 
USA HIGH 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA HIGH 
USA HIGH 
USA HIGH 
FRG El 
USA LOW 
USA LOW 
USA LOW 
USA ME 
USA MED 
USA ME 
USA LOW 
USA LOW 
USA LOW 
USA LOV 
USA LOV 
USA LOV 
CAN CANL 
USA MED 
USA LOV 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
FRA El 
USA HIGH 
USA LOW 
USA LOW 
USA LOW 
USA LOW 
USA HIGH 
USA MED 
USA LOW 
SWE E 
USA LOW 
USA HIGH 
USA MED 
USA MED 
USA MED 
USA MED 
USA HIGH 
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314/875-5570 
207/764-4167 
203/789-1848 
901/521-1303 
199/424-9610 
14/731-8283 
14/731-8283 
15/889-5790 
18/632-3993 
199/884-7450 
199/884-7450 
199/884-7450 
19/884-7450 
199/884-7450 
199/884-7450 
10) 4530099 
10) 4524923 
10) 4532002 
703/691-8200 
703/691-8200 
703/691-8200 
703/691-8200 
703/691-8200 
813/858-6970 
813/858-6970 
517/695-6751 
517/695-6751 
517/695-6751 
303/832-3447 
303/832-3447 
303/832-3447 
(421) 170997 
619/352-5823 
707/421-0106 
619/955-7050 
904/422-0016 
904/422-0149 
904/721-8559 
315/788-1816 
805/945-4962 
808/661-7688 
203/686-1238 
203/686-1238 
803/648-0237 
519/641-8362 
808/528-5300 
502/443-1086 
302/678-3569 
916/749-8015 
06/727-9510 
08/356-1818 
1) 47728080 

05/942-7898 
15/561-8401 
15/561-8401 
14/454-2893 
001/223-5165 
13/496-1332 
09/747-3011 
13/952-9000 
31) 450630 

07/282-0830 
214/630-5516 
708/790-4955 
708/790-4955 
708/790-4955 
615/694-0156 
703/352-3136 
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13214 
13215 
13216 
13224 
13226 
13226 
13226 
13226 
13227 
13227 
13227 
13227 
13230 
13231 
13234 
13233 
13234 
13235 
13236 
13240 
13242 
13244 
13245 
13246 
13247 
13251 
13251 
13251 
13251 
13252 
13252 
13252 
13252 
13253 
13253 
13256 
13273 
13273 
13273 
13300 
13301 
13314 
13314 
13314 
13334 
13341 
13341 
13344 
13345 


USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 
USA 


HIGH 
HIGH 
HIGH 
HIGH 
HIGH 
HIGH 
HIGH 
HIGH 
HIGH 
MED 
HIG 
HIG 
LOW 
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LOW 
LOW 


Ty ely pl 
HHH 
Qa 
GL 4G (4 


I I 
HOH 
Qa 

I I 


I 
H 
9) 

I 


I 
H 
9) 

I 


I 
H 
9) 

I 


H 
9) 
I 


Se st 
Hee 


HH ow 
Q OKOUEBDU 
xq 


Wed Apr 26 09:43:39 2017 
Arlington/Fairfax VA 
Fairfax VA 
Washington/Fairfax DC 
Bethesda/Fairfax MD 
Alexandria/Fairfax VA 
Arlington/Fairfax VA 
Fairfax VA 
Washington/Fairfax DC 
Bethesda/Fairfax MD 
Baton Rouge LA 
Brookfield WI 
Milwaukee/Brookfield WI 
Alexandria LA 
Sioux City IA 
Upland CA 
Gulfport MS 
Lawrence KS 
Wilmington NC 
Edmunton AB 
Indianapolis IN 
Petersburg VA 
Vineland NJ 
Frankfurt 
Newark Nd 
Elizabeth/Newark Nd 
Jersey City/Newark Nd 
Union/Newark Nd 
Newark Nd 
Elizabeth/Newark Nd 
Jersey City/Newark Nd 
Union/Newark Nd 
Miami FL 
Hempstead NY 
Mineola/Hempstead NY 
New York NY 
New York NY 
New York NY 
New York NY 
Tampa FL 
Morristown NJ 
Pueblo CO 
Norristown PA 
Salt Lake City UT 
Baton Rouge LA 
Newport Beach CA 
Anaheim/Newprt Beach CA 
Irvine/Newport Beach CA 
Santa Ana/Newprt Bch CA 
Newport Beach CA 
Anaheim/Newprt Beach CA 
Irvine/Newport Beach CA 
Santa Ana/Newprt Bch CA 
Longwood/Orlando FL 
Orlando FL 
Temple TX 
Downrs Grove/Gln Eln II 
Glen Ellyn Th 
Wheaton/Glen Ellyn IL 
New Orleans LA 
New Orleans LA 
Frederick/Myersville MD 
Hagerstown/Myersvill MD 
Myersville MD 
Toulouse 
Hull/Ottawa ON 
Ottawa ON 
Bellingham WA 
Springfield OH 
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703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
703/352-3136 
504/291-0967 
414/785-0630 
14/785-0630 
18/445-1800 
12/255-3834 
14/985-1153 
01/864-9441 
13/843-4870 
19/392-7913 
03/484-4404 
317/632-6408 
804/861-1788 
609/692-8943 
(69) 507-6736 
201/824-3044 
201/824-3044 
201/824-3044 

4 

4 

4 
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201/824-304 
201/824-304 
201/824-304 
201/824-304 
201/824-3044 
305/599-2900 
516/485-7422 
16/485-7422 
12/809-9660 
12/809-9660 
12/809-9660 
12/809-9660 
13/933-6210 
001/539-1222 
19/543-9712 
15/666-9190 
1/533-8152 
4/291-0967 
4/852-8141 
4/852-81 
14/852-81 
14/852-81 
4 
4 
4 


(oo ae) 


/852-81 
/852-81 
14/852-8141 
14/852-8141 
07/841-0217 
07/841-0217 
817/773-2545 
708/790-4955 
708/790-4955 
708/790-4955 
504/525-2014 
504/525-2014 
301/293-9504 
301/293-9504 
301/293-9504 
(61) 300291 
613/563-2910 
613/563-2910 
206/671-7750 
513/322-8855 


| 
| 4 
L41 
| 4 
| 
| 4 
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13346 Kankakee/Bradley IL USA Lov BB C 
13346 Bradley IL USA LOW BB C 
13354 Chico CA USA LOV BB C 
13357 Bryan TX USA LOW BB C 
13364 Missoula MT USA LOt BB C 
13365 Pascagoula MS USA LOt BB C 
13430 Minot ND USA LOV BB C 
13446 Red Bank NJ USA LOV BB C 
13446 Eatontown/Red Bank NJ USA LOb BB C 
13446 Long Branch/Red Bank NJ USA LOv BB C 
13450 Elmira NY USA LOV BB ¢ 
13451 Rome ITA E2 BG <G 
13452 Turin ITA E2 Bie. 
13524 Fayetteville AR USA LOt BB C 
13524 Springdale/Fayettevl AR USA LOv BB C 
13535 Honolulu HI USA MED Cc 
13541 Colorado Springs CO USA MED BB C 
13552 Bakersfield CA USA LOV BB C 
13553 Harrisburg/Lemoyne PA USA MED BB C 
13553 Lemoyne PA USA MED BB C 
13554 Richland WA USA MED BB C 
13557 Port Arthur TX USA LOW BB C 
13557 Nederland/Pt. Arthur TX USA LOW BB C 
13572 Springfield MO USA LOW BB C 
13573 Austin TX USA HIGH BB C 
13576 Fresno CA USA LOW BB C 
13577 Shreveport LA USA LOW BB, <¢ 
13601 Birmingham AL USA HIGH BB C 
13602 Birmingham AL USA HIGH BB C 
13603 Louisville KY USA MED BBS 
13614 Long Beach CA USA MED BB .€ 
13614 Norwalk/Long Beach CA USA MED BB C 
13614 San Pedro/Long Beach CA USA MED BB C 
13616 Little Rock AR USA MED BB C 
13617 Philadelphia PA USA HIGH BB C 
13620 Mobile AL USA MED BB Cc 
13623 Akron OH USA MED BB C 
13624 Toledo OH USA MED BB C 
13626 Memphis TN USA MED BeBe VC 
13641 Burton MI USA LOW BB C 
13643 Madrid ESP E2 Ge G 
13645 Lansing MI USA MED BB “C 
13646 Fort Worth TX USA MED BB Cc 
13646 Alington/Fort Worth TX USA MED BB C 
13650 Columbia SC USA MED BB C 
13651 Columbia SC USA MED By Bt iG 
13653 Ft. Wayne IN USA LOW BB oC 
13655 Huntsville AL USA MED BB Cc 
* Node 4003 is listed for many different countries. 
Enhanced Global Connection Service w 
2576, 3512, 3513, and 4003. 
B=BELL 103/113 (300 bps) or BELL 212A (1200 bps) 


C=CCITT V.21(300 bps) 


mode 
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ms 


20 


or CCITT V.22 bis(2400 bps) 


or CCITI 


815/935-2352 
815/935-2352 
916/343-4401 
409/823-1090 
406/542-0472 
601/769-0121 
701/838-2140 
908/758-0337 
908/758-0337 
908/758-0337 
607/737-9065 
(6) 8550340 

(11) 2480125 
501/442-0234 
501/442-0234 
808/528-5300 
719/590-1003 
805/325-0371 
717/975-9881 
717/975-9881 
509/375-3367 
409/721-3400 
409/721-3400 
417/881-6225 
512/448-1096 
209/442-4328 
318/688-5840 
205/942-7898 
205/942-7898 
502/499-9825 
310/436-6033 
310/436-6033 
310/436-6033 
501/666-6886 
215/592-8750 
205/460-2515 
216/376-8330 
419/255-7705 
901/527-8122 
313/743-8350 
( 
3) 
8 
8 
8 
8 
2 
2 


1) 7661900 
117/484-5344 
17/332-9397 
17/332-9397 
003/254-7563 
03/254-7563 
19/422-2581 
05/882-1519 
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"Told ya...Should a killed me last year!" 
by Knight Lightning & Dispater 


Special Thanks: Dr. Williams, Holistic Hacker, Nihil, and The Pope 


SummerCon /92 
June 26-28, 1992 
Executive International Hotel 


"SummerCon... What is it? In many ways, SummerCon is much more than 
just a convention that attracts America’s greatest phreaking and 
hacking personalities. SummerCon is a state of mind. 


Hackers by nature are urged on by a hidden sense of adventure to 
explore the unknown, to challenge the unchallenged, to reach out and 
experiment with anything and everything. The realization that we are 
not alone in our quest sometimes comes as a great gift and the 
opportunity to meet one’s heroes, partners, and idols can be the most 
awe-inspiring aspect of the hacker community -- this is what SummerCon 
is all about. 


On the surface, SummerCon looks like a handful of youths hanging out at 
a hotel in St. Louis, Missouri. To me, it is more like one of those 
madcap movies you see on late night Home Box Office or something. No 
real point or direction, rebels without cause, all in the name of 
frantic fun and games. The atmosphere surrounding SummerCon is that of 
a dream world where once a year you can escape to a fantasy where 
ingenuity is king and you have friends around you at every moment. 
SummerCon itself may only last a weekend, but the friendships last a 
lifetime." 


—- Knight Lightning, Phrack 28, File 8 (PWN Special on SummerCon ’ 89) 


SummerCon! At last, a return to the original idea behind the event. It was 
great! It was crazy! It was a party! It was everything it should have been 
and more. 


When Taran King, Forest Ranger, and Knight Lightning first conceived the idea 
of SummerCon in late 1986, they probably never imagined that they would all 
three still be involved six years later or just how popular their high-school 
dream would become. 


It seemed as though nothing could top SummerCon ’89. It was a great turnout 
of 23 people, there was a serious conference, there was also sorts of mischief 
and mayhem, and all in all, everyone had a great time. In 1990, SummerCon 
coincidentally took place on the same weekend on which the United States 
government dropped charges on Knight Lightning. The turnout was less than ten 
people and the conference was anything, but a success. 
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In 1991, SummerCon tried something new. The theme that year was CyberView and 
it had a special focus on civil liberties issues. The turnout was average, 
but something was missing. Finally, in 1992, the spirit of SummerCon was 
reborn anew. 


Setting Up For SummercCon / 92 
Setting up SummerCon this year was a tricky situation. Knight Lightning had 
moved to Washington, D.C., Dispater didn’t live in St. Louis, Taran King was 
working full time, and Forest Ranger was nowhere to be found. Luckily, there 
was Rambone. With help from Taran King, Rambone set forth to make sure that 
the hotel accommodations and the conference room arrangements were taken car 

of and without his help, SummerCon might possibly not have happened. 


All sorts of other arrangements had to be made as well. We wanted this year’s 
conference to be very special and so for the first tim ver, we decided to 
embark on the risky enterprise of designing and selling Phrack/SummerCon 
t-shirts. Knight Lightning and Dispater worked together on the design work 
and Dispater took care of the art and manufacturing. For those who haven’t 
seen or heard about these shirts before, a brief description is in order. 


Phrack/SummerCon '92 T-Shirts 

There were only a very limited number of shirts made for the conference and 
they were sold out. A re-order was issued, mostly for people who attended the 
conference (but didn’t get a shirt because of the small supply). A few shirts 
were reserved for people that were unable to attend. Unlike the Legion of 
Doom, Internet World Tour shirts, Phrack has no plans at this time to sell 
shirts to the general public. If there is a change in policy, we will let the 
readers know immediately. 


The shirts are standard white, short-sleeved t-shirts with no pockets. 


Front: On the left breast there is a picture resembling Oliver Wendall Jones 
(the computer hacker from the comic strip Bloom County). He is 
swinging his sword while standing at ground zero inside the cross hairs 
of a rifle. Circling above him are the words, "SummerCon ’92" and 
below him, "June 26-28 St. Louis, MO." 


Back: PHRACK 
Magazine 


When You Care Enough 
To Indict The Very Best 


PHRACK: 1 Secret Service: 0 


911’s A JOKE! 


The information contained 
herein should not be disclosed 
to unauthorized persons. It is 
meant solely for use by authorized 
employees of the BELLSOUTH Corporation 
or any of its subsidiaries. 


Executive International Hotel... Not A Best Western Anymore? 

All parties concerned decided that we should return to the site where our best 
conferences had been held, the Executive International Best Western Hotel, but 
we had a surprise waiting for us when we arrived for the conference. It turned 
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out that the Executive International was no longer a Best Western, in fact 

they had gone bankrupt. To make matters worse, the bank that foreclosed on the 
property failed as well -- in other words, the Executive International was now 
owned by the United States Government! 


SummerCon Begins 
There was so much going on and there were so many people at the conference, 
that there is no possible way to give a play-by-play of events at SummercCon. 


Knight Lightning arrived the Thursday before and Dispater flew in in the wee 
hours of the morning on Friday. When KL arrived with TK at the hotel around 
1 PM, the conference was already in full swing with groups of guys from Texas 


and Boston congregated outside the hotel wearing Phrack t-shirts and already 
trading war stories. Perhaps the biggest surprise was the arrival of Doc 
Holiday, who no one had been able to contact to invite -- of course the 


surprise was more on Erik Bloodaxe than anyone else. 


More and more people arrived during the day, and as they did, a strange 
sensation was shared among the alumni from SummerCon’s past. True, Tuc and 
Lex Luthor weren’t here, but outside of that, this was already looking like a 
reunion of all the people from all the SummerCons that had been before. 


Lucifer 666 was running around with Control C, The Disk Jockey was seen 
cruising the downtown bar scene with Forest Ranger and Tom Brokaw, Erik 
Bloodaxe and Doc Holiday called some of the girls they had met from the 
previous year’s convention. Everything was happening so fast, it was hard to 
keep track of, so we didn’t try. We just had fun. 


About 1/3 of the people at SummerCon went to see "Batman Returns." In light of 
the trip at the SummerCon of 1989, it seemed like a good idea. Others hung out 
poolside, roaming the hotel and its adjoining office complex, and still others 
raided the fr buffet at the Radison Hotel down the street. 


The Washington, D.C. contingent of SummerCon guests were content to sit in 
their room most the evening and explore Internet sites in the St. Louis area. 
Some went trashing, some hit the bars looking for women, and some sat in the 
room occupied by Restricted Data Transmissions (RDT) for some good information 
exchange. 


Meanwhile, an underage hacker named Pyro (gee that’s an original name) was the 
first to meet the pride and joy of Springfield, Illinois. Both of these young 
women claimed to be age 16 and Pyro was the first to experience some of their 
womanhood. One of "girls" was named Dena and she was in the mood for some 
action as well. Clawing at almost every guy at the hotel, she refused to 
leave. She finally disappeared into a room and was not heard from again until 
the next morning. 


SummerCon: The Conference 


The previous evening’s activates had taken their toll. When 12 noon came 
around, most of the hackers weren’t even awake yet, let alone prepared for the 
conference session. The meeting was re-scheduled to 1 PM, but in the meantime 


Knight Lightning passed out copies of Security Insider Report (from Interpact), 
information about InterTek, a ComputerWorld article by Chris ’Erik Bloodaxe’ 
Goggans (this article also appears in PWN 40/1), while Mr. Icom did the same 
with back issues of Cybertek. Emmanuel Goldstein was busy selling the new 
black 2600 t-shirts and passing out back issues of 2600 Magazine. Copies of a 
recent article about hackers doing computer security from the Boston Business 
Journal were also to be found compliments of RDT. RDT was also responsible for 
making this year’s SummerCon buttons. Holistic Hacker made some as well. 
Thanks to all parties concerned for your great work and efforts. 


Although it wasn’t exactly made available for everyone to take a close look at, 
Knight Lightning proudly showed off his pre-release copy of THE HACKER 
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CRACKDOWN by Bruce Sterling. This book, which will be available in hardback to 
the public on October 15, 1992, looks to be one of the most popular literary 
works on the world of hackers ever. It focuses on the raids in the Atlanta-LOD 
/Phrack/E911 case and Operation Sun Devil. It is believed that Knight 
Lightning himself appears on the cover of the book. 


With the gavel-like banging of a lineman test set, Knight Lightning formally 
called the meeting to order at about 1:15 PM. He expressed his appreciation 
for the massive attendance (there were at least 60 people actually at the 
SummerCon meeting). Rambone made a quick note about the activities of the 
previous night as laughter and jokes about the "cyber-nymphs" erupted from all 
around the room. 


Dispater took the floor for a moment to welcom veryone as well and then 
expressed his gratitude to the members of RDT for all of their help in 
producing Phrack issues during the past year. A discussion about who owned the 
hotel began briefly and then the first conference speaker was called to the 
floor. 


1. The Gatsby 


"I’m sure you’re all familiar by now with the media stories of the ’1000-member 
ring of hackers’ that supposedly have been invading the credit bureaus of CBI/ 
Equifax, but the story isn’t true and there is a lot more going on." 


Gatsby explained that a hacker named The Prisoner (aka Multiplexor) from 
Indianapolis (and apparently also to some extent from Long Island) flew to San 
Diego to see a girl, supposedly on a carded ticket. 


While in San Diego, he allegedly broke into computers at Zale’s Jewlery store 

and pulled credit card info from their point-of-sales system. After he vacated 
the rented room he had been staying in, he foolishly left behind the credit 
ce 
a 


ard printouts and his former landlord (whom he owed money to) discovered them 
nd called the San Diego Police Department. 


Sometime later, Multiplexor was met at his new accommodations at the Sleepy 
Time Motel in San Diego by the police. The FBI was brought into the case and 
he was kept at the Marriott Hotel for two weeks, all expenses paid! While 
under government supervision, Multiplexor logged into several systems, 
including Scantronics BBS. 


During the course of the investigation, a hacker known as The Crypt Keeper came 
forward to tell what he knew about the hacker underground. He eventually 
would give the police access to Scantronics BBS logs he had in his possession 
after using The Gatsby’s password to login to the system. 


These logs were used by the police to gain search warrants for Scantronics BBS 
and its now unhappy former sysop, Kludge. 


[The full details, police reports, warrants, and an interview with The Crypt 
keeper appears in Phrack World News 40/1.] 


2. Agent Steal 


Agent Steal gave a very informative talk about his dealings with Kevin Poulson, 
know to some as Dark Dante. AS related some of the experiences and adventures 
that the two of them had been through several years ago and talked about how 
Kevin used to break into central offices on a daily bases. Poulsen even had 
special equipment set up in his apartment to prevent him from being traced. 
Poulsen of course was the subject of a federal indictment and appeared on an 
episode of Unsolved Mysteries. He has since been taken into custody and is 
awaiting trial. 


Agent Steal himself had spent a short time in prison on some bogus charges that 
were brought against him to elicit his help in prosecuting Poulsen. He refused 
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to assist, but he eventually was released anyway. He said that he was looking 
forward to something different now, but he may have been referring to the Ozzy 
Osbourne concert later that night in St. Louis. Agent Steal is working on a 
book about his adventures with Poulsen called "Data Thief" and he expects it to 
be published in the near future. 


3. Emmanuel Goldstein, 2600 Magazine, Editor 


"Many people mistrust the government and big business, and they want to know 
how to fight back." 


Emmanuel Goldstein spoke about the First Amendment and why 2600 Magazine has 
been able to exist and grow over the years despite th vents that haunted 
Phrack in 1990. During 2600’s eight years in existence, the magazine has never 
once been directly harassed by the government. The main reason he believes 
that Phrack was hit and 2600 left alone is because 2600 is a printed (hardcopy) 
publication. 


However, 2600 is in need of good writers and will print anything, leaked or 
sent to them, it doesn’t matter. 2600 has never been sued, although they are 
often threatened with legal action [See PWN 40/3 for the latest threats against 
2600 from Bellcore]. 2600 has a subscription list of 1500 and a newstand 

of 3000. 


He also spoke about some of their press releases that were issued in order to 
alert people about insecure systems, but that the information is never acted 
upon until something happens. People always like to blame the magazine for 
giving the details on how to do something (such as opening Fed Ex drop boxes), 
but never take action to correct the problems the magazine exposes. 


A few people had questions for Emmanuel. For example, he was asked, "How do 
you morally justify hacking and the type of information published in 2600?" He 
responded by pointing out that 2600 only prints information about security 
flaws which need to be addressed and fixed. 


Emmanuel was also asked if there was any fallout from the Simplex lock hacking 
article which described how to hack Simplex locks with out any tools and in 
less than 20 minutes (often less than 3 minutes). Given that Simplex locks are 
widely used at universities and Federal Express drop boxes, one would expect 
some sort of action. Emmanuel replied that he was surprised that there hadn’t 
been much of a response or any action taken against 2600 because of the 
article. However, based on what many readers have told him, it seems that 
nobody has even changed the default combinations! 


4. Control C [Legion of Doom] 


Control C has been a hacker surrounded by a lot of controversy over the years, 
from his days with the Legion of Doom through his employment and termination 
from Michigan Bell security. 


He addressed the circumstances that led to his finding work with Michigan Bell. 
In 1987, Control C had started to log into Michigan Bell computers almost ona 
daily basis for the purpose of becoming better acquainted with C programming. 
During one 4 hour session, Michigan Bell Security traced his call back to 
Chicago (where he had been in school at the time). The next day, *C had moved 
back to Detroit and he received a call from some gentlemen who wanted to invite 
him to lunch. 


When he showed up, he was greeted by Michigan Bell Security personnel and the 
country sheriff’s department. The result was a job where his main 
responsibility was to find flaws in their computer security by any means 
necessary. Over the years, Control C found well over 100 different holes and 
other weaknesses in their systems. 


As time went on and key people left and were replaced by staff with more 
conservative attitudes, a new vice president (and former police officer) came 
in and decided it was no longer fashionable to employ a hacker. Control C was 
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informed that he must leave despite the need for his services. 


Shortly after Control C agreed to depart, the Secret Service became involved. 
They wanted to bring charges on “C for the original break-ins at Michigan Bell 
that led to his employment. It didn’t matter that Michigan Bell had signed 
documents that they would not bring charges. It didn’t prevent the Secret 
S) 
P 


ervice from coming after him in 1990 (right during the same time as the E911 
hrack case and LOD-Atlanta cases began). 


Control C was requested to take a polygraph. However, the timing was not good 
and “C’s lawyer request a new time. Now more than a year and a half since the 
request was made, “C has not heard back from the Secret Service. Today *C has 
moved on to a new vocation. 


5. Signal Surfer 


Signal Surfer voiced his concerns about the bad reputation hackers have in the 
computer industry when in reality, most people in the industry are hackers in 
the first place. H xpressed an interest in trying to get people together to 
work on changing the stereotype of the modern hacker and helping hackers find 
legitimate jobs in the computer field. 


6. PredatOr, TAP Magazine, Editor; Blitzkrieg BBS, Sysop 


PredatOr gave a short update on the current status of TAP and tried to explain 
why he hadn’t produced an issue in over a year. Legal problems (something 
about being accused of stealing a laptop computer) that were taking up his time 
and resources were at fault. However, he says that those issues have been 
resolved and that TAP will start publishing again with issue #106 sometime this 
fall. 


He gave his promise that he would not just fold the magazine and rip everyone 
off who had sent him money. 


7. Mr. Icom, Cybertek, Editor 


Similar to PredatOr, Mr. Icom expressed his apologies for having been somewhat 
delinquent in getting new issues of his magazine out. He claimed that issue #7 
would be released in the near future. 


8. Erik Bloodaxe (Chris Goggans) [Legion of Doom] [Comsec Data Security, Inc.] 


It was only a year ago at SummerCon ’91 that Erik Bloodaxe, Doc Holiday, and 
Malefactor proudly announced the formation of Comsec. Now, the following year, 
it seemed that events had come full circle. What had happened to Comsec? Why 
did it go out of business? What is the deal? That’s what everyone wanted to 
know and what Goggans was prepared to discuss. 


One of the factors that contributed to the failure of Comsec was operating 
costs associated with creating the company in the first place. Unfulfilled 
promises of investment in the company from people like Kenyon "Malefactor" 
Shulman and a whisper campaign against them by others in the computer security 
industry and a criminally negligent press hurt them badly, so much in fact they 
could not recover. 


Goggans continued his tale of corruption and unfair play in the security 
community. For example, there was an agreement between Goggans and ISPNews 
about Goggans writing a regular column in their bi-monthly publication. 
However, after he submitted his first article, the newly formed editorial board 
decided against allowing it to be published. They said it was common for the 
editorial board to not allow sensitive articles in their magazine. But when 
ISPNews was asked what other contributors had their articles reviewed lik 

this, they could produce no names. It should also be pointed out that among 
the members of the editorial board is one William J. Cook, formally an 


11.txt Wed Apr 26 09:43:39 2017 7 


assistant United States Attorney in Chicago the same prosecutor who is 
responsible for the cases against Phrack co-founder Craig Neidorf (Knight 
Lightning), Shadow Hawk, Steve Jackson Games, Len Rose, The Mentor, and Chris 
Goggans himself! 


But it didn’t end there! Someone on the editorial advisory board (without 
permission from Goggans) forwarded his article to the head of security for 
SprintNet. Goggans received a threatening letter from SprintNet that called 
his article potentially libelous and claimed that it contained inaccuracies 
and proprietary company information. 


But waitasec if the article contains confidential information then how could it 
be innaccurate? And if it’s inaccurate then how could it divulge useful 
security flaws in their security? 


Most recently, Goggans wrote an article for ComputerWorld (see PWN 40/1) about 
hackers and computer security. It addresses Tymnet and Telenet security 
issues. He discussed how hackers exploit these networks and how they can be 
stopped. He read the article aloud in full. It was typical of most security 
articles detailed, technically rounded, and somewhat dry. There were no big 
security revelations or tips. 


He then went on to read some of the editorial replies of people responding to 
his article in subsequent issues of ComputerWorld. The audience did not 
approve of their negative respons 


Finally, the discussion turned to the situation with MOD. Goggans talked about 
the persistent harassment he had been subjected to by Phiber Optik and other 
members of his alleged New York based organization. 


Goggans said that in addition to the usual childish prank calls he would often 
receive, MOD obtained his credit information including his credit card numbers 
and posted them on bulletin boards and IRC. They were also responsible for 
changing his residential home telephone long distance service from U.S. Sprint 
to AT&T so they could more easily obtain his long distance calling records. 


He was not alone -- other partners at Comsec and Doc Holiday’s (Scott Chasin) 
mother were also harassed. Harassing a hacker is one thing, but going after a 
man’s family and livelihood is clearly stepping beyond the bounds of a hacker’s 
code of ethics. Something had to be done aboutthe problem, so Comsec decided 
to end MOD’s reign of criminal obnoxiousness by any means necessary. 


There was a debate as to the proper way to handle this situation. Goggans 
revealed that he eventually turned to the FBI for assistance, who were 
surprising helpful. Some people at SummerCon were critical of his admission. 


Emmanuel Goldstein was the most outspoken of those who responded. "If we start 
resorting to asking the FBI to resolve our problems, then that is a worse 
violation than what MOD did to you. The more appropriate response would be to 
use the same tricks to get back at them." 


Emmanuel also gave an example of what he meant. One day, his office starting 
receiving lots of calls from people who wanted trips to Europe. It turned out 
that an answering machine at a travel agency had been left with an outgoing 
message that told callers to contact both John Maxfield and Emmanuel Goldstein 
and gave out both their numbers. Maxfield solved the problem by called the 
feds... 2600 hacked the answering machine and changed the message to something 
more innocuous. 


However clever Emmanuel’s ideas might be, Goggans stated that, "legitimate 
business people cannot resort to illegal means to correct such a situation. We 
had no other alternatives." 


The debate continued for 30 minutes until, eventually, Knight Lightning stepped 
in, pointed out that this discussion could go on forever, and that it was time 
to start closing up shop. 
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9. DrunkFux, HoHoCon, Director 
Before the meeting was officially concluded, dFx had a few things to discuss 


concerning how the guests had been conducting themselves in the hotel and he 
wanted to relate an experience he had at HoHoCon ’91. 


"The rowdiness at HoHoCon made last night at SummerCon look like a daycamp." 


Drunkfux explained that the managers at the hotel for HoHoCon blamed the 
conferences guests for all sorts of damage, and threatened to hold dFx 
financially responsible. The manager even threatened to bill his credit card 
for the damage. dFx responded by calling his credit card company and they 
informed him that what the hotel had threatened to do was illegal and they 
would be more than happy to prosecute the Hilton Hotel if they attempted to 
bill dFx for such charges. 


The Hilton staff claimed that some conference guests set fire to part of a 
hallway, but refused to show dFx the damage when asked. dFx’s attorney (a 
relative who had gotten involved at this point) asked if any fire alarms had 
gone off. The reply was no. The attorney then informed the Hilton staff that 
he would be happy to sue them on behalf of the conference guests for 
endangering their lives by placing them in accommodations with defective fir 
alarms. The Hilton staff changed their story. 


Another claim against the HoHo’ers was that they had engaged in and allowed 
underage drinking. The attorney pointed out that the hotel’s own bartenders 
W 
W 


ere responsible for serving many of them and if Hilton’s claim was true, he 
ould be forced to call the state and have the hotel’s liquor license revoked. 
he Hilton staff changed their story. 


_ 


This sequence of point/counter-point repeated itself a few times until all 
claims were dropped. 


A few days later, the two hotel managers who had previously accused dFx of 
damage went to his house to personally apologize. They gave him coupons for 
free nights the next time he stays at one of their hotels. dFx recorded the 
meeting on videotape and he joked around about putting the scene into gifs and 
distributing it to a BBS near you! 


Afterwards 

After the official meeting, many guests left the hotel to eat, trash, and 
explore the city. Frosty and some of the other GCMS-MechWarriors started a 
game of Hacker (Steve Jackson Games) in the conference room. Many people soon 
wandered over to Northwest Plaza Mall; where the trouble began. 


Rule #4 


About 10 or more people (including Emmanuel Goldstein, The Conflict, Erik 
Bloodaxe, Doc Holiday, and Signal Surfer) had entered the Northwest Plaza mall 
and a couple of them had baseball caps on... backwards. 


A few minutes later, they were approached by mall security who told them that 
wearing their hats backwards was a violation of Rule #4 and was not allowed. 
Specifically the security guard said, "All clothing must be worn in the way it 
was meant to be worn." Go figure, aren’t hats supposed to be worn on your 
head? This was more than Emmanuel and the others would take. They marched 
right into Sears and Emmanuel bought everyone (who didn’t already have a hat) a 
bright red St. Louis Cardinals baseball cap. 


Now all of them had their hats on backwards and they started strolling around 
the mall soon catching the eye of another always-alert rent-a-cop, mall 
security guard. After telling them to turn their hats around (and dropping his 
walkie-talkie in his attempt to call for backup), the security guard was 
approached by Emmanuel who wanted to discuss this Rule #4. 
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Another guard mumbled something about how a case on the matter had already gone 
to the appellate court, but he neglected to mention the outcome and we have 
been unable to find any details about case. 


The security guards (now in full force) told Emmanuel this policy was in fact 
posted at all entrances and then they threw everyone out of the mall. Emmanuel 
says that he circled the mall noting that the rule was actually only posted at 
2 of the 12 entrances. Another interesting rule was #6, which made it illegal 
to have a cellular phone, beeper, or any other device capable of making sounds 
in the mall. Erik Bloodaxe had broken this rule when he had played "Mary Had A 
Little Lamb" on Signal Surfers cellular phone. 


Nightfall 

Towards the late afternoon about half of the Con ventured to the St. Louis 
waterfront on the Mississippi (Laclede’s Landing) where the riverboats, bars 
and the Arch is found. 


Holistic Hacker showed videos in his room including: 


"ESS Phun" - A humorous raid of a Bell Central Office 
by three hackers. 

"Unsolved Mysteries" - The Kevin Poulsen episode. 

"Rudolph the Heavy-Metal Reindeer" No explanation. 

"Good Morning America" — See Doc Holiday EAT his own hand! 

"Now It Can Be Told" - Phiber Optik, Emmanuel Goldstein, and 
Knight Lightning on Geraldo. 

"SummerCon 7’ 89" - Highlights of SummerCon ’89. 

"SummerCon /’91" —- Highlights of SummerCon ’91. 

Later in the evening, things just went out of control. Smoke bombs were going 

off, power outages were occurring, rooms were filling up with trash found in 

dumpsters at major computer and telecommunications office buildings. Dena was 


back stalking new prey (and found it). 


Agent Steal and DrunkFux went to the Ozzy Osbourne concert while Erik Bloodaxe 
and Doc Holiday went out with the girls from last year’s conference. They 
didn’t make it back to the hotel until the next morning <wink wink>. 


Security guards were running around threatening to send people to jail for no 
specific reason other than being disruptive. 


The only serious discussions that night took place in the RDT room. 


The guests slowly began waking up just before mandatory checkout time from the 
hotel. As they gathered in the lobby and outside for last minute discussions 
and group photos, the group began to slowly dwindle in size. A few had to catch 
flights right away, a few would be staying until Monday morning, but everyone 
promised to return next year. 


PWN *** PWN *** PWN { SummerCon '’92 } PWN *** PWN *** PWN 
PWN *** PWN *** PWN { Guest List! } PWN “** PWN “** PWN 


Agent Steal Erik Bloodaxe The Not 
Albatross Father Crime Omega 

Apollo Phoebus Forest Ranger OPii 

Aragorn Frosty Phaedrus 

Black Phoenix Gateway Phantom Phreaker 
Brian Oblivion The Gatsby The Pope 

Bucky Golgo 13 PredatOr 

The Butler Holistic Hacker The Public 


Coder Decoder Hunter Pyro 
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Colin 

The Conflict 
Control C 
Count Zero 


Cray-Z Phreaker 


Crimson Death 
Dark Angel 
Dark Creaper 
Disk Jockey 
Dispater 

Doc Holiday 
Dr. Cypher 
Dr. Williams 
Drab Jester 
Drunkfux 
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Emmanuel Goldstein 
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Junkmaster 
Just Dave 
Knight Lightning 
Krynn 

Lord MacDuff 
Louis Cypher 
Lucifer 666 
Magic Man 
Minor Threat 
Mr. Icom 
Mucho Maas 
Mudge 

Nat X 

Night Ranger 
Nihil 

Norris 


Rambone 
Sarlo 
Scooter 

The Serpent 


Signal Surfer 


Slack Master 
Slave Driver 
Taran King 
Tom Brokaw 
Video Vance 
Voyager 
Weapons 
White Knight 
Wind Runner 


A total of 73 people and they are what made it worth remembering! 


A Few Things We Learned At SummerCon 


By The Pope and Nihil 


- Don’t try to buy beer at stores that have gas pumps. 


— How correctly wear a baseball hat. 
—- "Playing" cellular phones is illegal. 


- All mall security officers are imported from Mississippi. 
Internation only have two temperatures: 


-— The showers at th 
freeze and scald. 


— Frosty bought a lifetime supply knee-high tube socks befor 


Executiv 


style in the 1970's. 


—- How to pick up underage girls. 
— Control C should have chosen the alias 
- After being awake for 43 hours 


disappears. 


"No Control Cc." 
(and drinking for 30), 


OPii’s accent 


they went out 


—- Hanging out with Crimson Death and Phantom Phreaker means worrying about 


- Erik Bloodaxe and The Pop 
—- Agent Steal has big hair. 


— Taran King has perfect hair. 
- DO NOT get into a car with Voyager and The Public. 


being drug tested at work Monday morning. 
— Hanging out with Crimson Death, 
teach you how to defeat Moday morning’s drug test. 


Phantom Phreaker, 


the Siskel and Ebert of pornographic fil 


Erik Bloodaxe wil 


Ll 


ImS . 


of 
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Scantronics BBS Seized By San Diego Police Department July 1, 1992 


By Knight Lightning and The Gatsby 
Special Thanks to Bruce Bigelo (San Diego Union-Tribune) 


"Multiplexor and The Crypt Keeper Spill Guts" 


A lot of stories have been circulating in the press over the past two months 
about hordes of credit card stealing computer hackers that were disrupting 
the economy of the United States. It all began with rumors about Multiplexor, 
a small time hacker that was thought to have spent some time in Long Island, 
New York and supposedly is from Indiana. The story was that Multiplexor had 
carded a plane ticket to San Diego to see a girl or meet some friends, but 
when he landed, he was met by the police instead. 


here that information or the supposed "1,000 member hacker ring" theory came 
rom, we might never know, but we know do know the facts in this case thanks 

o police reports and warrant affidavits supplied by the court and acquired by 
he Gatsby with help. 


Ht hs 


7 
qd 


hat information and more is now available. 


For purposes of understanding the following, "SEMENICK" and "MARCOV" are both 
the same person. You might know him better under the names of Multiplexor or 
The Prisoner. Later in this file, you will see references to a person named 
Kevin Marcus who is better known to some as The Crypt Keeper. 


SAN DIEGO POLICE DEPARTMENT 
Investigators Follow-Up Report 


CASE NUMBER: N/A 

DATE: March 23, 1992 

TIME: 1300 Hours 

SUBJECT: Damage Assessment of and Intelligence gathering on Illegal entry 
(Hacking) Computer Systems and the Illegal use of Credit Cards. 

SUSPECT: SEMENICK, John Edward AKA: MARCOV, Eric Edward 

VICTIM: Zales Jewelry Store 

LOCATION: 4465 La Jolla Village Drive, San Diego, CA 

DETECTIVE: Dennis W. Sadler (I.D.# 2486) 

On March 31, 1992, I received a ARJIS 4 form from Officer Smyth (I.D.# 3871) 


regarding some papers found by a Mr. Maurice Osborne at his residence. 


Mr. Osborne had asked an individual by the name of Eric MARCOV, who had rented 
a room from him, to leave. After MARCOV left the house, Mr. Osborne discovered 
some papers with what appeared to be credit card information on them. Mr. 
Osborne called the police and reported what he found. 


Officer Smyth collected the papers and wrote the attached report. After 
reviewing these papers, I learned that they did in fact contain some personal 
information on individuals which included the person’s name, address, credit 
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card number, card expiration date, and social security number. It appeared 
that the person who wrote these notes was possibly using this credit card 
information illegally. 


I contacted Mr. Osborne by phone on March 31st. He verified the contents of 
the report and he stated that he feels MARCOV may still be in town. On April 
2nd, I was contacted by Mr. Osborne who learned that MARCOV was staying at a 
motel in the beach area named Sleepy Time. 


On April 2, 1992, while in the beach area, I came across the Sleepy Time Motel. 
I contacted the motel manager, William Gainok. I asked Mr. Gainok if he had 
a 
t 


person registered there by the name of Eric MARCOV. He said that he did and 
hat Marcov was in room number 108. 


At approximately 8:40 am, I knocked on the door to room number 108. A white 
male answered the door. I asked him if he was Eric MARCOV. He said yes. I 
identified myself as a San Diego Police Detective and told him that I needed 
to talk to him about some questionable credit card activity. 


As he opened the motel room door, I saw more papers like <those> given to me by 
Mr. Osborne laying on the floor near the door with more credit card information 
on them. After being invited into the motel room, I asked MARCOV if he knew 
why I was here. He said I think so. I asked MARCOV why he thought so. He 
said the credit cards. 


At this point, I was only interviewing MARCOV regarding the papers found at Mr. 
Osborne’s residence. I had no active case or any evidence indicating that 
MARCOV was involved in, or a suspect of any criminal or illegal activity. 


I asked MARCOV if he had any I.D. on him. He said that he did not. MARCOV 
gave me the following information; Eric Edward MARCOV, DOB 05-15-74, then 
changed the year to 73. He said he was 18 going on 19. He did not know his 
social security number. When asked if he had a drivers’ license, he said that 
he has never had one. MARCOV appeared to be between the age of 17 to 19 years 
old. 


While asking him about papers, he started talking about computers and gaining 
information from various systems. He talked for about 10 minutes. After that, 
I decided to call the FBI because hacking was involved in obtaining the credit 
card information and numbers, plus the information was coming from out of 
state. MARCOV also sounded like he knew a lot about computer hacking and was 
involved in it himself. 


At 8:58 am, I called the local office of the FBI and told them what I had and 
asked if they would be interested in talking with MARCOV. I asked MARCOV prior 
to calling the FBI, if he would be willing to talk with them about his computer 
activities. He agreed to talk with them. 


A short later Special Agent Keith Moses called me back at the motel. I 
explained to him what I had and what MARCOV was willing to talk about. After 
going over the case with Moses, he agreed to come out and talk with MARCOV. 


Both Moses and I interviewed MARCOV regarding his hacking activities and 
knowledge. MARCOV was extensively involved in the hacking community during 

the last four years and had some superior knowledge about what was happening in 
the hacker world. We later learned that he had been arrested for computer 
crimes in early 1991 in Indianapolis. We attempted to contact the 
investigators that worked that case, but we never received any calls back after 
numerous attempts. 


During the interview, I attempted to confirm MARCOV’s true identity. I asked 
him for his parents’ information. He said he did not remember their home phone 
numbers, but they had a phone. He also could not remember their home 
addresses. I asked him for his parents’ employment information. He said that 
his father worked for a local (his home town) turbine company. 


I called the information number for the local phone company and then called the 
company to verify this information. However, the company’s personnel office 
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d not locate any employ 


matching the name given to me by MARCOV. MARCOV 


also gave me the school and year he graduated. I called the local school 
district’s administrative office and discovered they had no record of MARCOV 
attending or graduating from their school system. 


I confronted him with this 
rmation. His true name was John Edward SEMENICK, DOB 05-15-75. I located 
his father’s work number and contacted him. He was very uninterested about his 
son’s whereabouts or condition. 
bus ticket for transportation home, he said he would not. His father further 
stated that when his son decided to come home, he’1l have to find his own way. 


info 


SEME 
lear 
offi 


I co 


ce. 


information and he finally gave me his true 


When asked if he would supply an airline or 


INICK’s parents are divorced and he lives with his father. However, we 
ned that his mother had filed a runaway report with the local sheriff’s 


ntacted his mother and she seemed a little more concerned, but said she 


would not provide a ticket or funds for his return. I asked both parents if 
while John was in San Diego would they have any problems if their son assisted 


us i 


n our investigation. 


I exp 


lained to them that he was not facing any known 


criminal charges at that point and that the information he would be giving us 
would be for damage assessment and intelligence gathering purposes on hackers 


Both parents stated that they had no problem with him assisting us if he was 
being charged. Because SEM 
don him, we contacted the 


not 
file 


ENICK was a juvenile and a runaway report was 


U.S. Attorney’s office, the District Attorney’s 
nile Hall Probation Intake Officer for advice. 


no problem with him giving us information. 
le hall as a runaway and then released to a 


The intake officer explained to us that because 


him, they would only keep him for one evening 
his own again the next day. 


r SEMENICK went through the runaway process and was being released, w 

ed him back up. The FBI agreed and furnished the fund’s to put SEMENICK up 
hotel, give him living expenses, and then provide transportation for him 

.  SEMENICK was put up in a suite at the Mission Valley Marriott. He was 
allowed to do what he wanted while staying at the hotel and to see his friends 


ENICK 


Juvenile Division, and the Juve 
They advised us that their was 
SEMENICK was booked into Juveni 
halfway home for the evening. 
his parents would not send for 
and then he would be let go on 
Afte 

pick 

ina 

home 

at any time. 

Duri 

the hotel room next to SEM 

SEME 


inte 
valu 
by a 


Duri 
pers 
volu 
call 


nother source. 


ons by phone who were 
ntarily signed an FBI 
s during the course o 


ng the period of April 


ng SEMENICK’s stay at the Marriott, either myself or Agent Moses stayed in 


's. During the three day stay at the hotel, 


NICK was able to provide us with some very useful information and 
lligence. It was not enough to make any arrest, but we obtained some very 
able information. We were not able to independently verify the information 


3rd to April 5th, 1992, SEMENICK contacted numerous 
involved in computer hacking. SEMENICK willingly and 
consent form giving us permission to record his phone 


our 


investigation. There were numerous tape 


recorded phone conversations involving at least 4 separate individuals. 


Duri 


ng this same period o 


fF time, information in data format was also downloaded 


from another individual’s computer located on the East Coast to the computer 
ad set up. The information we received during the download was current 
credit records just obtained from CBI credit reporting company by this person, 
a CBI manual written in part by "Kludge" a San Diego hacker, and numerous 

vr files/documents involving illegal activity such as "carding." "Carding" 
is a term used by the hacker community regarding the illegal or fraudulent use 


we h 


othe 


of credit cards or credit card numbers by hackers nationwide. 


SEMENICK stated that he had been a member of a local BBS called Scantronics 
he was an active hacker. 
DGE" and contains hundreds of files and documents. He said that most of 


when 
"KLU 


manu 


He stated that the board is run by a guy named 


these files and documents contained on "KLUDGE’s" computer are "how to" 


als. This means that they instruct the person who obtains them through 
Scantronics BBS on how to do various things both legal and illegal. Some of 
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the illegal activities that are covered on this BBS is carding, phone hacking, 
ATM fraud, and credit bureau information. 


We obtained three documents written by or put out by either "KLUDGE" or 
Scantronics BBS. 


THIS INVESTIGATION IS ONGOING AT THIS TIME AND FURTHER INFORMATION AND EVIDENCE 
WILL BE ADDED. 


SAN DIEGO POLICE DEPARTMENT 
Investigators Follow-Up Report 


CASE NUMBER: N/A 

DATE: April 30, 1992 

TIME: 0700 Hours 

SUBJECT: Computer Hacking 

SUSPECT: N/A 

VICTIM: N/A 

LOCATION: N/A 

DETECTIVE: Dennis W. Sadler (I.D.# 2486) 

On April 16, 1992, I was contacted by Kevin Marcus. Marcus learned that we 


were investigating individuals who were illegally logging (hacking) into 
various computer systems nationwide. Marcus runs a local computer bulletin 
board system (BBS) called The Programmer’s Paradise. Marcus was concerned 
about the illegal activities had had seen on various local BBSs and contacted 
me. 


Marcus also said that he had received computer messages from a person who goes 
by the name (handle) of Knight Lightning in New York who asked him if he heard 
anything about our investigation. Knight Lightning told Marcus that on April 
3rd a reporter from San Diego by the name of Bigelo had contacted and talked to 
him about our ongoing investigation. 


Enclosure 1: 


Date: Fri, 10 Apr 1992 18:14:11 -500 
To: knight@eff.org 

From: Craig Neidorf <knight@eff.org> 
Subject: Runaway Teen Hacker Picked Up? 


I was just contacted by a reporter in San Diego about a hacker case. 
Apparently there is a teenage hacker from Indiana who ran away from home to 
California to see some girl there. The local police and the FBI supposedly 
picked him up on April 3rd and he remains in their custody uncharged while he 
is telling them all sorts of information on hacker rings across the nation. 


Does anyone have any clues as to who this kid is or what’s going on? 


:Knight Lightning 


Enclosure 2: 


Date: Thu, 16 Apr 1992 22:25:17 -0400 
From: Craig Neidorf <knight@eff.org> 
To: tck@netlink.cts.com 

Subject: Re: Hi. 


Bruce Bigelo, Union Tribune. Left his number at the office. Nothing going on, 
but I understand that you called him. 


Craig 
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Marcus offered to assist us. I asked if he knew of a BBS called Scantronics. 
He said that he did and that he had been a member of that BBS and view the 
files on that board in the past to see what the board carried. Marcus is a 
computer science major at a local college and is doing research in the anti- 
virus field. Marcus stated that the board carried a lot of technical data, but 
had nothing regarding his subject. Marcus also belongs to other local and out-— 
of-state BBSs where he talks with other individuals with his same interest. 


Marcus stated that he was last on Scantronics BBS about a month ago and he had 
seen numerous computer files that involved CBI and carding. Carding is a term 
used by hackers who are involved in the illegal or fraudulent use of credit 
cards and their numbers. These credit card numbers are obtained from credit 
reporting companies such as CBI and TRW, by illegally accessing (hacking) their 
way into those company computers and reading or copying private individuals 
credit reports and information. 


Most copies of credit reports from these companies will show a person’s name, 
current and previous addresses, social security number, employer, salary, and 
all current credit history including all credit cards and their account 
numbers. They <the hackers> then use these credit card numbers to obtain 
goods. 


If one of the hackers used an account number he found on a credit report that 
he illegally pulled from the credit reporting company, the victim would most 
likely not find out that their card had been illegally used until the next 
billing cycle which could be as much as 45 days after the illegal transaction 
took place. According to the credit card industry, this is one of the most 
risk free and safest way to commit credit card fraud. 


Marcus said that the person’s name who ran this BBS was Jeremy. He did not 
know his last name, but the handle he is known by is "KLUDGE." I asked if he 
knew the phone number to this BBS and he gave me 423-4852. The BBS phone 
number, the operator’s first name, and <the operator’s> handle matched the 
information we had learned earlier. 


Marcus also gave me two disks <that> contained some files which had been 
downloaded (left on his BBS) by other persons on his system. He regularly 
checks his board and removes or deletes files regarding questionable or illegal 
activity such as carding. 


I viewed both of these disks and they contained some very interesting files. 

These files included various topics <such as> an auto theft manual, CBI manual, 
[RW manual, American Express card info, and many other files which if 
downloaded or copied by another person, that person could easily gain illegal 
access to various credit reporting companies and commit various other illegal 
types of activity. 


I told Marcus if he came across any further information regarding this type of 
activity or further information about the BBS called Scantronics to please 
contact me. 


On April 17, 1992, I met Marcus and he said that he had logged onto Scantronics 
last night by using an access number a friend gave him. This same friend had 
let him use his access number to gain access to this BBS on many prior 
occasions. He did this on his own, without any direction whatsoever from me or 
any other law enforcement official. 


Marcus handed me a 5 1/4" computer disk and said that it contained some file 
listings anda list of all validated users. Marcus also stated that the disk 
contained a copy of the messages that were sent to him through his BBS by the 
person in New York regarding our investigation [those messages displayed above 
from Knight Lightning]. 


He asked me if I wanted him to log on and see for myself what was on "KLUDGE’s" 
BBS. I told him that I would have to consult with the D.A.’s office first. 
However, I was unable to get a hold of our D.A. liaison. I told <Marcus> that 
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After talking to D.A. Mike Carlton, I advised Marcus not to go into Scantronics 
BBS unless it was for his own information. However he said that if he came 
across any further information during his normal course of running his own BBS, 
he would notify me. 


[The police report also contained 60 pages of printouts of postings and text 
files found on Scantronics BBS. It is also made very clear that Kevin Marcus 
(aka The Crypt Keeper) accessed Scantronics BBS by using the password and 
account number of The Gatsby. Files include: 


- "Credit Bureau Information" which sounds harmless enough to begin with and 
turns out is actually a reprint of an article from the September 27, 1992 
issue of Business Week Magazine 


- "Advanced Carding" by The Disk Jockey, which dates back to 1987. 


- "The Complete CBI Manual of Operations" by Video Vindicator and Kludge, 
dated October 10, 1991. 


Aftermath 


On April 23, 1992, a search warrant was issued in the municipal court of the State of Calif 
ornia in the county of San Diego which authorized the seizure of: 


A. All telephone company subscriber information to include service start date, 
copy of most current billing statement, current credit information, and 
location of telephone service to the following telephone numbers; 

(619) XXX-XXXX and (619) XXX-XXXX and any other telephone number information 
in any chain of call forwarding, to or from the listed phone numbers. 


B. All telephone company records which includes subscriber information, 
service start date, copy of most current billing statement, current credit 
information, and location of telephone service phone numbers to which calls 
are being forwarded to or from, from the listed phone numbers. 


CERTIFICATION TO DEFER NOTIFICATION TO SUBSCRIBER 


The Court finds there is substantial probable cause to believ 
notification to the subscriber whose activities are recorded in the 
records described above would impede or destroy this investigation. 
Accordingly, the court certifies the request of the San Diego Police 
Department that notification to the subscriber be deferred pending 
further order of this court. 


On April 30, 1992, a search warrant was issued in the municipal court of the 
State of California in the county of San Diego which authorized the search of 
Kludge’s residence and the seizure of: 


All computer equipment and paraphernalia use in computer hacking, or apart 
of the BBS known as Scantronics which includes, but is not limited to 
monitor(s), keyboard(s), CPU(s), which may or may not contain hard disk 
drive(s), floppy drive(s), tape drive(s), CD rom drive(s), modem(s), 
fax/modem(s), all hard copies (paper copies) of any computer files which 
have been stored or currently stored on/in a computer system, all 
documents whether in hard or data form which show how to operate any 
computer program or computer file, all memory storage devices which may 
include hard disk drive(s), 5 1/4" and 3 1/2" computer memory storage 
disks, all computer memory storage and computer back up tapes, and all 
computer CD rom disks capable of computer data storage; and, documents and 
effects which tend to show dominion and control over said premises and 
computer system, including fingerprints, records, handwritings, documents 
and effects which bear a form of identification such as a person’s name, 
photograph, social security number, or driver’s license number and keys. 
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The warrant was used immediately and Scantronics BBS and much more was seized. 


The Crypt Keeper Responds 
Date: Wed, 17 Jun 92 09:13:50 PDT 
From: tck@bend.UCSD.EDU (Kevin Marcus) 
To: knight@eff.org 

Subject: Hmm. 


I’1ll start at the beginning... 


On April 3rd, I arrived at my workplace (a computer store) around 3 pm. 
Multiplexor is sitting in the back with some FBI agent and Detective Dennis 
Sadler. The reason they chose my store for technical support is because Dennis 
and one of my managers are very good friends. 


I saw what was happening, and I saw Multiplexor call up Kludge’s board and try 
to log on, but alas he was not validated. Nonetheless, that same day I told 
Gatsby and Kludge what was up, because they are/were my friends and I didn’t 
want something bad to happen to them. 


A few days later, my boss suggested that I tell Dennis that I was on Kludge’s 
board awhile ago, but that I was not anymore because they might have found 
something on me. So the next time I saw him (he comes in about once a week, 
still), I told him that I was on the board awhile ago, but that I wasn’t 
anymore. He asked a few stupid questions and I didn’t really say a whole bunch 
about. 


He eventually found out that I had warned Kludge about his board. I am not 
really sure how, I sure as heck didn’t tell him. He then told me that I 

nearly blew their investigation and for interfering with an investigation the 
maximum penalty was like 5 years or something like that. He was getting ready 
to arrest me and take me down to the county courthouse when my boss was able to 
convince him that I was a good kid, not looking for trouble, and that I would 
get him something to re-strengthen. So, even though Dennis didn’t tell me 
specifically to get something from Kludge’s board, he told me that what he 
needed to get his case back up to par was an idea of what was on the board, 
like a buffering of his system. 


That night I called up Gatsby and got his password from him. I called and 
buffered. The next time that I saw him [Sadler], I told him what I had done. 
He wanted to know how I got on Kludge’s board, and I told him through a 
friend’s account. He asked me which friend, and I said "The Gatsby." He then 
started asking me a bunch of questions about Gatsby such as, "What is his real 
name?" And, at first I said that I didn’t want to tell him, and then he said 
that I was withholding evidence and he could bust me on that alone. So I told 
him his name and that he lived in XXXXX (a suburb of San Diego). They already 
had him and Kludge in phone conversations over Kludge’s line since it was taped 
for a while so they knew who he was in the first place. 


If Sadler didn’t have anything hanging over my head, such as interfering with 
an investigation, and/or withholding evidence, then I would not have said jack, 
more than likely. My first contact with him was on suggestion of my boss, who 
is a good friend of his, and he might have told my boss something which made 
him worry and think that I would be arrested for something, I do not know. 


Now, if I was a nark, then I can assure you that a LOT more people would have 
gone down. I have a plethora of information on who is who, who is where, who 
does what, etc. and, even though it’s old, I bet a lot of it is true. Tt oh 
wanted there to be another Operation Sun-Devil, then I would have given all of 
that information to him. But I didn’t, because that is not at all what I had 
wanted. I didn’t want anyone to get busted (including myself) for anything. 


If I were a nark, then I would probably have given him a lot more information, 
wouldn’t you think? 
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I sure do. 


I am not asking anyone to forget about it. I know that I screwed up, but there 
is not a whole bunch about it that I can do right now. 


When Sadler was here asking me questions, it didn’t pop into my mind that I 
should tell him to wait and then go and call my attorney, and then a few 

minutes later come back and tell him whatever my lawyer said. I was scared. 
Hackers Aren’t The Real Enemy June 8, 1992 


By Chris Goggans (ComputerWorld) (Page 37) 


(Goggans is a 23-year old hacker who is currently seeking employment with 
anyone who won’t make him cut his hair.) 


For years articles have been published about people who call themselves 
"hackers." These have been written by people who have investigated hackers, 
who have been the targets of hackers, who secure systems against hackers and 
who claim to know hackers. As a member of the so-called "computer 
underground," I would like to present the hacker’s point of view. 


I hope you will put aside any personal bias you may have toward people who call 
themselves hackers because it is probably based on media reports rather than 
real contact. 


I also hope you won’t refuse to read this because you have a problem with my 
ethics. Over the past 11 years, operating under the pseudonym Erik Bloodaxe, I 
had opportunities to become rich beyond the dreams of avarice and wreak great 
havoc on the world’s computer networks. Yet I have done neither. I have 
looked behind doors that were marked "employees only" but have never disrupted 
the operation of business. Voyeurism is a far cry from rape. 


Illegal, but not criminal 


Undeniably, the actions of some hackers are illegal, but they are still hardly 
criminal in nature. The intention of most of these individuals is not to 
destroy or exploit systems but merely to learn in minute detail how they are 
used and what they are used for. The quest is purely intellectual, but the 
drive to learn is so overwhelming that any obstacle blocking its course will be 
circumvented. Unfortunately, the obstacles are usually state and federal laws 
on unauthorized computer access. 


The overwhelming difference between today’s hackers and their 1960s MIT 
namesakes is that many of my contemporaries began their endeavors too young to 
have ready access to computer systems. Few 13-year-olds find themselves with 
system privileges on a VAX through normal channels. 


My own first system was an Atari 8-bit computer with 16K of memory. I soon 
realized that the potential of such a machine was extremely limited. With the 
purchase of a modem, however, I was able to branch out and suddenly found 
myself backed by state-of-the-art computing power at remote sites across the 
globe. Often, I was given access by merely talking to administrators about the 
weak points in their systems, but most often my only access was whatever 
account I may have stumbled across. 


Many people find it hard to understand why anyone would risk prosecution just 
to explore a computer system. I have asked myself that same question many 
times and cannot come up with a definitive answer. I do know that it is an 
addiction so strong that it can, if not balanced with other activities, lead to 
total obsession. Every hacker I know has spent days without sleep combing the 
recesses of a computer network, testing utilities and reading files. Many 
times I have become so involved in a project that I have forgotten to eat. 


Hackers share almost no demographic similarities: They are of all income 
levels, races, colors and religions and come from almost every country. There 
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are some shared characteristics, however. Obsessive-compulsive behavior (drug 
or alcohol abuse, gambling, shoplifting) is one. Others have a history of 
divorce in their families, intelligence scores in the gifted to genius level, 
poor study habits and a distrust of any authority figure. Most hackers also 
combine inherent paranoia and a flair for the romantic -- which is apparent in 
the colorful pseudonyms in use throughout the hacker community. 


In most cases, however, once hackers reach college age -- or, at minimum, the 
age of legal employment -- access to the systems they desire is more readily 

available through traditional means, and the need to break a law to learn is 

curtailed. 


Popular media has contributed greatly to the negative use of the word "hacker." 
Any person found abusing a long-distance calling card or other credit card is 
referred to as a hacker. Anyone found to have breached computer security on a 
system is likewise referred to as a hacker and heralded as a computer whiz, 
despite the fact that even those with the most basic computer literacy can 
breach computer security if they put their minds to it. 


Although the media would have you believe otherwise, all statistics show that 
hackers have never been more than a drop in the bucket when it comes to serious 
computer crime. In fact, hackers are rarely more than a temporary nuisance, if 
they are discovered at all. The real danger lies in the fact that their 
methods are easily duplicated by people whose motives are far more sinister. 
Text files and other information that hackers write on computer systems can be 
used by any would-be corporate spy to help form his plan of attack ona 
company. 


Given that almost everyone is aware of the existence and capabilities of 
hackers -- and aware of how others can go through the doors hackers open th 
total lack of security in the world’s computers is shocking. 


Points of entry 


The primary problem is poor systems administration. Users are allowed to 
select easily guessed passwords. Directory permissions are poorly set. Proper 
process accounting is neglected. Utilities to counter these problems exist for 
every operating system, yet they are not widely used. 


Many systems administrators are not provided with current information to help 
them secure their systems. There is a terrible lack of communication between 
vendors and customers and inside the corporate community as a whole. 


Rather than inform everyone of problems when they are discovered, vendors keep 
information in secret security databases or channel it to a select few through 
electronic-mail lists. This does little to help the situation, and, in fact, 
it only makes matters worse because many hackers have access to these databases 
and to archives of the information sent in these mailing lists. 


Another major problem in system security comes from telecommunications 
equipment. The various Bell operating companies have long been the targets of 
hackers, and many hackers know how to operate both corporate and central office 
systems better than the technicians who do so for a living. 


Increased use of computer networks has added a whole new dimension of 
insecurity. If a computer is allowed to communicate with another on the same 
network, every computer in the link must be impenetrable or the security of all 
sites is in jeopardy. The most stunning examples of this occur on the 
Internet. With such a wide variety of problems and so little information 
available to remedy them, the field of computer security consulting is growing 
rapidly. Unfortunately, what companies are buying is a false sense of 
security. The main players seem to be the national accounting firms. Their 
high-cost audits are most often procedural in nature, however, and are rarely 
conducted by individuals with enough technical expertise to make 
recommendations that will have a real and lasting effect. 


Ultimately, it is the responsibility of the systems administrators to ensure 
that they have the proper tools to secure their sites against intrusion. 
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Acquiring the necessary information can be difficult, but if outsiders can get 
their hands on this information, so can the people who are paid to do the job. 


THE GREAT DEBATE 


Phiber Optik v. Donn Parker 


Cyberpunk Meets Mr. Security June 1992 


By Jonathan Littman (PC Computing Magazine) (Page 288) 


The boy cautiously approached the table and asked the tall, distinguished bald 
gentleman in the gray suit if he could join him. The boy’s conference name tag 
read Phiber Optik; the gentleman’s read Donn Parker. One was a member of the 
Legion of Doom, the infamous sect of teenage hackers charged with fraud, 
conspiracy, and illegal computer access in 1990; the other was a legendary 
security expert. 


The unlikely pair had been brought together by an unusual gathering, the 
nation’s first Computers, Freedom, and Privacy conference, held in the San 


Francisco Bay Area on the last weekend of March 1991. They were part of an 
eclectic mix of G-men, Secret Service agents, prosecutors, privacy advocates, 
and hackers who had come to s the other side up close. 


Only weeks before, Optik’s laptop computer had been seized by state police in 
an investigation begun by the Secret Service. Optik and fellow hackers Acid 
Phreak and Scorpion were among the first to come under the scrutiny of the 
S 
s 
a 


cret Service in the days of Operation Sun Devil, a 14-city sweep in the 
pring of 1990 that resulted in 42 seized computers, 23,000 confiscated disks, 
nd four arrests. 


The criminal charges brought against Optik and his cohort included illegal 
computer access and trading in stolen access codes. Optik, a juvenile at the 
time of his initial questioning, spent a day in jail and was later convicted of 
a misdemeanor for theft of services. 


Parker knew the story well. Over the last two decades, the former Lutheran 
Sunday school teacher has interviewed dozens of criminals to whom computers 
were simply the tools of the trade. Along the way, he earned a worldwide 
reputation as the bald eagle of computer crime. Parker speaks frequently to 
law-enforcement agencies and corporations as a consultant to SRI International, 
a leading research and management firm based in Menlo Park, California. His 
books Fighting Computer Crime and Crime by Computer, countless articles, anda 
large Justice Department study on computer ethics have established him as the 
foremost authority on the hacker psyche. 


PARKER: How do you view the ethics of getting into someone’s computer system? 


OPTIK: I know what your point of view is because I’ve read your papers and 
I’ve listened to you talk. I know that you think any entry, you know, 
any unauthorized entry, is criminal. 


I can’t say I agree with that. I do agree that anyone who’s an 
impressionable teenager, who’s on the scene and wants to break into as 
many computers as is humanly possible to prove a point, has the 
potential to do damage, because they’re juveniles and have no idea what 
they’re doing, and they’re messing around in places that they have no 
business being. 


At the time, I was 17 years old and still a minor. There was no way I 
was going to be able to buy a Unix, a VAX, my own switching system. 
These are the things I’m interested in learning how to program. It 
would not have been possible to access this type of computer 
development environment had I not learned how to break into systems. 
That’s the way I see it. 


PARKER: What are you doing at this conference? What’s your purpose? 


PARK! 


OPTI 


PARK! 


OPTI 


PARK! 


OPTI 


PARK! 


OPTI 
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Basically I want to be exposed to as many people as possible and hear 
as many people’s views as I can. 


What’s your ultimate purpose then-what would you like to do as far as 
a career? Do you think this is a way for you to get into a career? 


Well, of course, I hope to enter the computer industry. Just by being 
here, I hope to talk to people like you, the many people who are 
professionals in the field, hear their views, have them hear my views. 


See, the thing I regret the most is that there is this communication 
gap, a lack of dialogue between people who proclaim themselves to be 
hackers and people who are computer professionals. I think if there 
were a better dialogue among the more respectable type of hackers and 
the computer professionals, then it would be a lot more productive. 


How do you tell the difference between a more responsible type of 
hacker? 


I realize that its a very big problem. I can see that it’s pretty 
impossible to tell, and I can clearly understand how you come to the 
conclusions that you initially state in your paper about how hackers 
have been known to cheat, lie, and exaggerate. I experienced that 
firsthand all the time. I mean, these people are generally like that. 
Just keep in mind that a large number of them aren’t really hardcore 
hackers they’ re impressionable teenagers hanging out. Its just that 
the medium they’re using to hang out is computers. 


I don’t consider myself part of that crowd at all. I got into 
computers early on. Like when I was entering junior high school. I was 
really young, it must have been preteen years. I’m talking about 12 or 
13 years old when I got a computer for Christmas. 


I didn’t immediately go online. I’m not one of these kids today that 
get a Commodore 64 with a modem for Christmas because they got good 
grades on their report card. The reason I would have called myself a 
hacker is, I was hacking in the sense of exploring the world inside my 
computer, as far as assembly language, machine language, electronics 
tinkering, and things of that nature. That truly interested me. 


The whole social online thing I could really do without because that’s 
where these ideas come from. You know, this whole negative, this bad 
aftertaste I get in my mouth when I hear people put down the whole 
hacking scene. Its because of what they’re hearing, and the reason 
they’re hearing this is because of the more outspoken people in this 
"computer underground" and the twisted coverage in the media, which is 
using this whole big hype to sell papers. 


And the people who are paying the price for it are people like me; and 
the people who are getting a twisted view of things are the 
professionals, because they’re only hearing the most vocal people. 

It’s another reason why I’m here, to represent people like myself, who 
want other people to know there are such things as respectable hackers. 
You know hacking goes beyond impressionable young teenage delinquents. 


How would you define hacking? 


It’s this overall wanting to understand technology, to be able to 


communicate with a machine on a very low level, to be able to program 
it. Like when I come upon a computer, it’s like my brain wants to talk 
to its microprocessor. That’s basically my philosophy. 


And does it matter to you who actually owns the computer? 


Usually it does. Oh, at first it didn’t matter. The mere fact of 
getting into Unix, and learning Unix, was important enough to warrant 
me wanting to be on the system. Not because of information that was in 
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there. I really don’t care what the information is. 


You know there’s that whole Cyberpunk genre that believes information 
should be free. I believe in computer privacy wholly. I mean if 
someone wants something to be private, by all means let it be private. 
I mean, information is not meant for everyone to s if you design it 
as being private. That’s why there is such a thing as security. 


If someone wants to keep something private, I’m not going to try to 
read it. It doesn’t interest me. I couldn’t care less what people are 
saying to each other on electronic mail. I’m there because I’m 
nterested in the hardware. 


B- 


How is anyone else going to know that you’re not interested in reading 
their private mail? 


That’s a problem I have to deal with. There’s not a real solution in 
the same way that there’s no way that you’re really going to be able 

to tell whether someone’s malicious or not. Hackers do brag, cheat, 
a 
b 


nd exaggerate. They might tell you one thing and then stab you in the 
ack and say something else. 


I’ve interviewed over 120 so-called computer criminals. 
Right. 


I’ve interviewed a lot of hackers, and I’ve also interviewed a lot of 
people engaged in all kinds of white-collar crime. 


Yeah. 


And it seems to me that the people I have talked with that have been 
convicted of malicious hacking and have overcome and outgrown that 
whole thing have gone into legitimate systems programming jobs where 
there is great challenge, and they’re very successful. They are not 
engaged in malicious hacking or criminal activity, and they’re making a 
career for themselves in technology that they love. 


Right. 


Why couldn’t you go that route? Why couldn’t you get your credentials 
by going to school like I did and like everybody else did who functions 
as a professional in the computer field, and get a challenging job in 
computer technology? 


I certainly hope to get a challenging job in computer technology. But 
I just feel that where I live, and the way the school system is where I 
am, it doesn’t cater to my needs of wanting to learn as much about 
technology as fast as I want to learn. 


Yeah, but one of the things you have to learn, I guess, is patience, 
and you have to be willing to work hard and learn the technology as 
it’s presented. 


You know, you just have to remember that by being able to go places 
that people shouldn’t, I’m able to learn things about technology that 
schools don’t teach. It’s just that programs in local colleges where I 
am, they couldn’t even begin to grasp things that I’ve experienced. 


OK, so you want instant gratification then. 
It’s not so much gratification 

You’re not willing to spend four years in a-- 
I certainly am willing to go to college. 


Uh huh. 
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I definitely intend to go to college; I just don’t expect to learn very 
much concerning technology. I do expect to learn some things about 
technology I probably didn’t know, but I don’t expect to be exposed to 
such a diverse amount of technology as in my teenage years. 


OK, well, I can see impatience and a lack of opportunity to do all 
that stuff very quickly, but-—- 


I wouldn’t go so far as to call it impatience. I’d call it an 
eagerness to learn. 


PARKER: 


Fagerness to learn can be applied in the establishment process of 


OPTIK: 


PARKER: 
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PARKER: 
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education in all kinds of ways. You can excel in school. 


I was never Mr. Academia, I can tell you that right off the bat. I 
don’t find much of interest in school. Usually I make up for it by 
reading technology manuals instead. 


How are you going to spend four years in school if you’ve already 
decided you’re really not suited to be in school? 


Well, it’s not so much school as it is that I feel constrained being in 
high school and having to go through junior high school and high school 
because of the way the educational program are tailored to like, you 
know --— 


Well, if you hold this direction that you’re going right now, you could 
very well end up as a technician repairing equipment, maintaining 
computers, and you could very well end up in a dead-end job. 


In order to break into a higher level of work, you need a ticket, you 
need a degree, you have to prove that you have been able to go to 
school and get acceptable grades. The route that you’re going doesn’t 
seem to me to lead to that. 


Now there are some people who have managed to overcome that, OK -- 
Geoff Goodfellow. Steve Wozniak. But those people are 1 out of 
100,000. All the other 99,000-odd people are technicians. They’re 
leading reasonable lives, making a reasonable income, but they’re not 
doing very big things. They’re keeping equipment running. 


Yeah. 


And if you have all this curiosity and all this drive and this energy 
(which is what it takes), and you go a route that gets you toa 


position where you can do real, exciting, advanced research... I 
mean, I’ve talked to a lot of hackers. I’m thinking of one in 
Washington, D.C., who was convicted of a computer crime. He went back 


to school, he’s got his degree, and he has a very top systems 
programming job. He said he finally reached a point where he decided 
he had to change the way he was going about this, because the way 
things were going, the future for him was pretty bleak. 


And it seems to me, hopefully, you may come to a realization that to 
do important things, exciting things, ultimately you’ve got to learn 
the computer-science way of presenting operating systems, and how to 
write programs of a very large, complex nature. 


Have you ever done that, have you ever written a really big computer 
program? 


I’ve written this 


There’s a discipline involved that has to do with learning how to be an 
engineer. It takes a tremendous amount of education and discipline. 
And it sounds to me like you lack the discipline. You want instant 
gratification, you want to be an expert now. And you end up being an 
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expert all right, but in a very narrow range of technology. 


You learn the Novell LAN, you learn some other aspect, you learn about 
a telephone company’s switching system. That doesn’t lead to a career 
in designing and developing systems. That leads to a career in 
maintaining the kind of hardware that you’ve been hacking. 


And it seems to me you’ve got to go back and learn the principles. 

What are the basic principles of an operating system? What are the 
basic principles of access control? Until you’ve gone back and learned 
those basics, you’re flying by the seat of your pants, and just picking 
up odds and ends of stuff that you can grab quickly. 


OPTIK: I don’t see it so much as grabbing things quickly. I’ve put a lot of 
time into studying very detailed things. It’s not so much popping in 
and popping out and whatever I find I’m glad I found it. I do spenda 

lot of time studying manuals and things. 


PARKER: Manuals are not going to do it. All you do in learning a manual is 
learn the current equipment and how it works. If you studied Donald 
Kanuth’s volumes on computer science programming and computer sciences, 
you would learn the theory of computer programming, you would learn 
the operating system theory, you would learn the theory that is the 
foundation on which all of these systems are built. 


OPTIK: But that’s the thing I guess I don’t do. I was never much concerned 
with theory of operation. I was always concerned with how things work, 
and how I can use them. Like how to program. I’11 admit I was never 
much into theory. It never interested me. Like with what I do-theory 
really doesn’t play any role at the present time. Of course, that’s 
subject to change at any time. I’m rather young 


A FRIEND WHISPERED in Optik’s ear that it was time to go. Still locked in 
debate, the hacker and the security man left the table and walked together 
toward the escalator. In profile, at the bottom of the moving stairs, they 
were an odd couple: Optik with his shiny, jet black hair, Parker with his 
shiny dome. 


Parker was speaking calmly, warning Optik that one day hacking wouldn’t seem 
so boundless, that one day his opportunities wouldn’t seem quite so vast. 
Optik fidgeted, glancing away. Conference attendees filed up the escalator. 


"I don’t want to be a hacker forever," blurted Optik. 


The next afternoon the bank of hotel phones was crowded with business people 
and conference attendees punching in to get their messages and make their 
calls. There was Optik, wedged between the suits, acoustic coupler slipped 
over the phone receiver, a laptop screen flickering before his eyes, his hands 
flitting over the keys. 


He was still young. 
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MOD Indicted July 8, 1992 


Taken from U.S. Newswire 


The following is the press release issued by the United States Attorney’s 
Office in the Southern District of New York. 


Group of "Computer Hackers" Indicted 
First Use of Wiretaps in Such a Case 


NEW YORK -- A group of five "computer hackers" has been indicted on charges of 
computer tampering, computer fraud, wire fraud, illegal wiretapping, and 
€ 
ai 


onspiracy, by a federal grand jury in Manhattan, resulting from the first 
nvestigative use of court-authorized wiretaps to obtain conversations and data 
transmissions of computer hackers. 


A computer hacker is someone who uses a computer or a telephone to obtain 
unauthorized access to other computers. 


The indictment, which was filed today, alleges that Julio Fernandez, a/k/a 
"Outlaw," John Lee, a/k/a "Corrupt," Mark Abene, a/k/a "Phiber Optik," Elias 
Ladopoulos, a/k/a "Acid Phreak," and Paul Stira, a/k/a "Scorpion," infiltrated 
a wide variety of computer systems, including systems operated by telephone 
companies, credit reporting services, and educational institutions. 


According to Otto G. Obermaier, United States Attorney for the Southern 
District of New York, James E. Heavey, special agent in charge, New York Field 
Division, United States Secret Service, William Y. Doran, special agent in 
charge, Criminal Division, New York Field Division, Federal Bureau of 
Investigation, and Scott Charney, chief of the Computer Crime Unit of the 
Department of Justice, the indictment charges that the defendants were part of 
a closely knit group of computer hackers self-styled "MOD," an acronym used 
variously for "Masters of Disaster" and "Masters of Deception" among other 
things. 


The indictment alleges that the defendants broke into computers "to enhance 
their image and prestige among other computer hackers; to harass and intimidate 
rival hackers and other people they did not like; to obtain telephone, credit, 
information and other services without paying for them; and to obtain 
passwords, account numbers and other things of value which they could sell to 
others." 


The defendants are also alleged to have used unauthorized passwords and billing 
codes to make long distance telephone calls and to be able to communicate with 
other computers for free. 


Some of the computers that the defendants allegedly broke into were telephon 
switching computers operated by Southwestern Bell, New York Telephone, Pacific 
Bell, U.S. West and Martin Marietta Electronics Information and Missile Group. 
According to the indictment, such switching computers each control telephone 
service for tens of thousands of telephone lines. 


In some instances, the defendants allegedly tampered with the computers by 
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adding and altering calling features. In some cases, the defendants allegedly 
call forwarded local numbers to long distance numbers and thereby obtained long 
distance services for the price of a local call. Southwestern Bell is alleged 
to have incurred losses of approximately $370,000 in 1991 as a result o 
computer tampering by defendants Fernandez, Lee, and Abene. 


Fh Ft 


The indictment also alleges that the defendants gained access to computers 
operated by BT North America, a company that operates the Tymnet data transfer 


network. The defendants were allegedly able to use their access to Tymnet 
computers to intercept data communications while being transmitted through the 
network, including computer passwords of Tymnet employees. On one occasion, 


Fernandez and Lee allegedly intercepted data communications on a network 
operated by the Bank of America. 


The charges also allege that the defendants gained access to credit and 
information services including TRW, Trans Union and Information America. The 
defendants allegedly were able to obtain personal information on people 
including credit reports, telephone numbers, addresses, neighbor listings and 
social security numbers by virtue of their access to these services. On one 


occasion Lee and another member of the group are alleged to have discussed 
obtaining information from another hacker that would allow them to alter credit 
reports on TRW. As quoted in the indictment, Lee said that the information he 
wanted would permit them "to destroy people’s lives... or make them look like 
saints." 


The indictment further charges that in November 1991, Fernandez and Lee sold 
information to Morton Rosenfeld concerning how to access credit services. The 
indictment further alleges that Fernandez later provided Rosenfeld’s associates 
with a TRW account number and password that Rosenfeld and his associates used 
to obtain approximately 176 TRW credit reports on various individuals. (In a 
separate but related court action, Rosenfeld pleaded guilty to conspiracy to 
use and traffic in account numbers of TRW. See below). 


According to Stephen Fishbein, the assistant United States attorney in charge 
of the prosecution, the indictment also alleges that members of MOD wiped out 
almost all of the information contained within the Learning Link computer 
operated by the Educational Broadcasting Corp. (WNET Channel 13) in New York 
City. The Learning Link computer provided educational and instructional 
information to hundreds of schools and teachers in New York, New Jersey and 
Connecticut. Specifically, the indictment charges that on November 28, 1989, 
the information on the Learning Link was destroyed and a message was left on 
the computer that said: "Happy Thanksgiving you turkeys, from all of us at MOD" 
and which was signed with the aliases "Acid Phreak," "Phiber Optik," and 
"Scorpion." During an NBC News broadcast on November 14, 1990, two computer 
hackers identified only by the aliases "Acid Phreak" and "Phiber Optik" took 
responsibility for sending the "Happy Thanksgiving" message. 


Obermaier stated that the charges filed today resulted from a joint 
investigation by the United States Secret Service and the Federal Bureau of 
Investigation. "This is the first federal investigation ever to use court- 
authorized wiretaps to obtain conversations and data transmissions of computer 
hackers," said Obermaier. He praised both the Secret Service and the FBI for 
their extensiv fforts in this case. Obermaier also thanked the Department of 
J 

i 
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ustice Computer Crime Unit for their important assistance in the 

nvestigation. Additionally, Obermaier thanked the companies and institutions 
hose computer systems were affected by the defendants’ activities, all of whom 
cooperated fully in the investigation. 


Fernandez, age 18, resides at 3448 Steenwick Avenue, Bronx, New York. Lee 
(also known as John Farrington), age 21, resides at 64A Kosciusco Street, 
Brooklyn, New York. Abene, age 20, resides at 94-42 Alstyne Avenue, Queens, 
New York. Elias Ladopoulos, age 22, resides at 85-21 159th Street, Queens, New 
York. Paul Stira, age 22, resides at 114-90 227th Street, Queens, New York. 
The defendants’ arraignment has been scheduled for July 16, at 10 AM in 
Manhattan federal court. 


The charges contained in the indictment are accusations only and the defendants 
are presumed innocent unless and until proven guilty. Fishbein stated that if 
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convicted, each of the defendants may be sentenced to a maximum of five years 
imprisonment on the conspiracy count. Each of the additional counts also 
carries a maximum of five years imprisonment, except for the count charging 
Fernandez with possession of access devices, which carries a maximum of ten 
years imprisonment. Additionally, each of the counts carries a maximum fine of 
the greater of $250,000, or twice the gross gain or loss incurred. 


In separate but related court actions, it was announced that Rosenfeld and 
Alfredo De La Fe [aka Renegade Hacker] have each pleaded guilty in Manhattan 
Federal District Court to conspiracy to use and to traffic in unauthorized 
access devices in connection with activities that also involved members of MOD. 


Rosenfeld pled guilty on June 24 before Shirley Wohl Kram, United States 
District Judge. At his guilty plea, Rosenfeld admitted that he purchased 
account numbers and passwords for TRW and other credit reporting services from 
computer hackers and then used the information to obtain credit reports, credit 
card numbers, social security numbers and other personal information which he 
sold to private investigators. Rosenfeld added in his guilty plea that on or 
about November 25, 1991, he purchased information from persons named "Julio" 
and "John" concerning how to obtain unauthorized access to credit services. 
Rosenfeld stated that he and his associates later obtained additional 
information from "Julio" which they used to pull numerous credit reports. 
According to the information to which Rosenfeld pleaded guilty, he had 
approximately 176 TRW credit reports at his residence on December 6, 1991. 


De La Fe pled guilty on June 19 before Kenneth Conboy, United States District 
Judge. At his guilty plea, De La Fe stated that he used and sold telephone 
numbers and codes for Private Branch Exchanges ("PBXs"). According to the 
information to which De La Fe pleaded guilty, a PBX is a privately operated 
computerized telephone system that routes calls, handles billing, and in some 
cases permits persons calling into the PBX to obtain outdial services by 
entering a code. De La Fe admitted that he sold PBX numbers belonging to Bugle 
Boy Industries and others to a co-conspirator who used the numbers in a call 
sell operation, in which the co-conspirator charged others to make long 
distance telephone calls using the PBX numbers. De La Fe further admitted that 
he and his associates used the PBX numbers to obtain free long distance 
services for themselves. De La Fe said that one of the people with whom he 
frequently made free long distance conference calls was a person named John 
Farrington, who he also knew as "Corrupt." 


Rosenfeld, age 21, resides at 2161 Bedford Avenue, Brooklyn, N.Y. Alfredo De La 
Fe, age 18, resides at 17 West 90th Street, N.Y. Rosenfeld and De La Fe each 
face maximum sentences of five years, imprisonment and maximum fines of the 
greater of $250,000, or twice the gross gain or loss incurred. Both defendants 
have been released pending sentence on $20,000 appearance bonds. Rosenfeld’s 
sentencing is scheduled for September 9, before Shirley Wohl Kram. De La Fe’s 
sentencing is scheduled for August 31, before Conboy. 


Contacts: 


Federico E. Virella Jr., 212-791-1955, U.S. Attorney’s Office, S. N.Y. 
Stephen Fishbein, 212-791-1978, U.S. Attorney’s Office, S. N.Y. 

Betty Conkling, 212-466-4400, U.S. Secret Servic 

Joseph Valiquette Jr., 212-335-2715, Federal Bureau of Investigation 


Editor’s Note: The full 23 page indictment can be found in Computer 
Underground Digest (CUD), issue 4.31 (available at ftp.eff.org 
/pub/cud/cud) . 

EFF Issues Statement On New York Computer Crime Indictments July 9, 1992 

Cambridge, MA The Electronic Frontier Foundation (EFF) issued a statement 


concerning the indictment of MOD for alleged computer-related crimes. 
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This statement said, in part, that EFF’s "staff counsel in Cambridge, Mike 
Godwin is carefully reviewing the indictment." 


EFF co-founder and president Mitchell Kapor said "EFF’s position on 
unauthorized access to computer systems is, and has always been, that it is 
wrong. Nevertheless, we have on previous occasions discovered that allegations 
contained in Federal indictments can also be wrong, and that civil liberties 
can be easily infringed in the information age. Because of this, we will be 
examining this case closely to establish the facts." 


When asked how long the complete trial process might take, assistant U.S. 
attorney Fishbein said "I really couldn’t make an accurate estimate. The 
length of time period before trial is generally more a function of the 
defense’s actions than the prosecution’s. It could take anywhere from six 
months to a year. 


Feds Tap Into Major Hacker Ring July 13, 1992 


By Mary E. Thyfault (InformationWeek) (Page 15) 


Law enforcement officials are taking the gloves off-and plugging their modems 
in-in the battle against computer crime. 


In one of the largest such cases ever, a federal grand jury in Manhattan 
indicted five computer "hackers" -- part of a group that calls itself MOD, for 
Masters of Deception -- on charges of computer tampering, computer fraud, wire 
fraud, illegal wiretapping, and conspiracy. 


Some of the hackers are accused of stealing phone service and selling 
information on how to obtain credit reports. The victims (a dozen were named 
in the indictments, but numerous others are likely to have been hit as well) 
include three Baby Bells, numerous credit bureaus, and BankAmerica Corp. 


For the first time, investigators used court-authorized wiretaps to monitor 
data transmissions over phone lines. The wiretapping comes as the FBI is 
unsuccessfully lobbying Congress to mandate that telecom equipment and service 
companies build into new technology easier ways for securities agencies to tap 
into computer systems. 


Ironically, the success of this wiretap, some say, may undermine the FBI’s 
argument. "They did this without th quipment they claim they need," says 
Craig Neidorf, founder of hacker newsletter Phrack. 


If convicted, the alleged hackers-all of whom are under 22 years old-could face 
55 years each and a fine of $250,000, or twice the gross gain or loss incurred. 
One charged with possessing an access device could face an additional five 
years. 


The vulnerability of the victims’ networks should be surprising, but experts 
say corporations continue to pay scant attention to security issues. For 
instance, despite the fact that the credit bureaus are frequent targets of 
hackers and claim to have made their networks more secure, in this case, most 
of the victims didn’t even know they were being hit, according to the FBI. 


Two of the victims, value-added network service provider BT Tymnet and telco 
Southwestern Bell, both take credit for helping nab the hacker ring. "We 
played an instrumental role in first recognizing that they were there," says 
John Guinasso, director of global network security for Tymnet parent BT North 
America. "If you mess with our network and we catch you -- which we always do 
—- you will go down." 


Second Thoughts On New York Computer Crime Indictments July 13, 1992 


By John F. McMullen (Newsbytes) 
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NEW YORK -—- On Wednesday, July 9th, I sat at a press briefing in New York 
City’s Federal Court Building during which law enforcement officials presented 
details relating to the indictment of 5 young computer "hackers". In 
describing the alleged transgressions of the indicted, United States Assistant 
Attorney Stephen Fishbein wove a tale of a conspiracy in which members of an 
evil sounding group called the "Masters of Destruction" (MOD) attempted to 
wreck havoc with the telecommunications system of the country. 


The accused were charged with infiltrating computer systems belonging to 
telephone companies, credit bureaus, colleges and defense contractors -—-— 
Southwestern Bell, BT North America, New York Telephone, ITT, Information 
America, TRW, Trans Union, Pacific Bell, the University of Washington, New York 
University, U.S. West, Learning Link, Tymnet and Martin Marietta Electronics 
Information and Missile Group. They were charged with causing injury to the 
telephone systems, charging long distance calls to the universities, copying 
private credit information and selling it to third parties -- a long list of 
heinous activities. 


The immediate reaction to the indictments were predictably knee-jerk. Those 
who support any so-called "hacker"-activities mocked the government and the 
charges that were presented, forgetting, it seems to me, that these charges are 
serious -- one of the accused could face up to 40 years in prison and $2 
million in fines; another -- 35 years in prison and $1.5 million in fines. [In 
view of that possibility, it further seems to me that it is a wasteful 
diversion of effort to get all excited that the government insists on misusing 
the word "hacker" (The indictment defines computer hacker as "someone who uses 
a computer or a telephone to obtain unauthorized access to other computers.") 
or that the government used wiretapping evidence to obtain the indictment (I 
t 
u 
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hink that, for at least the time being that the wiretapping was carried out 
nder a valid court order; if it were not, the defendants’ attorneys will have 
course of action). 


On the other hand, those who traditionally take the government and corporate 
line were publicly grateful that this threat to our communications life had 
been removed they do not in my judgement properly consider that some of 
these charges may have been ill-conceived and a result of political 
considerations. 


Both groups, I think, oversimplify and do not give proper consideration to the 
wide spectrum of issues raised by the indictment document. The issues range 
from a simple black-and-white case of fraudulently obtaining free telephone 
time to the much broader question of the appropriate interaction of technology 
and law enforcement. 


The most clear cut cases are the charges such as the ones which allege that two 
of the indicted, Julio Fernandez a/k/a "Outlaw" and John Lee a/k/a "Corrupt" 
fraudulently used the computers of New York University to avoid paying long 
distance charges for calls to computer systems in El Paso, Texas and Seattle, 
Washington. The individuals named either did or did not commit the acts 
alleged and, if it is proven that they did, they should receive the appropriate 
penalty (it may be argued that the 5 year, $250,000 fine maximum for each of 
the counts in this area is excessive, but that is a sentencing issue not an 
indictment issue). 


Other charges of this black-and-white are those that allege that Fernandez 
and/or L intercepted electronic communications over networks belonging to 
Tymnet and the Bank of America. Similarly, the charge that Fernandez, on 
December 4, 1991 possessed hundreds of user id’s and passwords of Southwestern 
Bell, BT North America and TRW fits in the category of "either he did it or he 
didn’t..." 


A more troubling count is the charge that the indicted 5 were all part of a 
conspiracy to "gain access to and control of computer systems in order to 
enhance their image and prestige among other computer hackers; to harass 

and intimidate rival hackers and people they did not like; to obtain telephone, 
credit, information, and other services without paying for them; and to obtain 
passwords, account numbers and other things of value which they could sell to 
others." 


13.txt Wed Apr 26 09:43:39 2017 6 


[To support this allegation, the indictment lists 26, lettered A through Z, 
"Overt Acts" to support the conspiracy. While this section of the indictment 
lists numerous telephone calls between some of the individuals, it mentions 
the name Paul Stira a/k/a "Scorpion" only twice with both allegations dated 
"on or about" January 24, 1990, a full 16 months before the next chronological 
incident. Additionally, Stira is never mentioned as joining in any of the 
wiretapped conversation -- in fact, he is never mentioned again! I find it 
hard to believe that he could be considered, from these charges, to have 
engaged in a criminal conspiracy with any of the other defendants. 


Additionally, some of the allegations made under the conspiracy count seem 
disproportionate to some of the others. Mark Abene a/k/a "Phiber Optik" is of 
possessing proprietary technical manuals belonging to BT North America while it 
is charged that Lee and Fernandez, in exchange for several hundred dollars, 
provided both information on how to illegally access credit reporting bureaus 
and an actual TRW account and password to a person, Morton Rosenfeld, who later 
illegally accessed TRW, obtained credit reports on 176 individuals and sold the 
reports to private detective (Rosenfeld, indicted separately, pled guilty to 
obtaining and selling the credit reports and named "Julio" and "John" as those 
who provided him with the information). I did not see anywhere in the charges 
any indication that Abene, Stira or Elias Ladopoulos conspired with or likewise 
encouraged L or Fernandez to sell information involving the credit bureaus to 
a third party 


Another troubling point is the allegation that Fernandez, Lee, Abene and 
"others whom they aided and abetted" performed various computer activities 
"that caused losses to Southwestern Bell of approximately $370,000." The 
$370,000 figure, according to Assistant United States Attorney Stephen 
Fishbein, was developed by Southwestern Bell and is based on "expenses to 
locate and replace computer programs and other information that had been 
modified or otherwise corrupted, expenses to determine the source of the 
unauthorized intrusions, and expenses for new computers and security devices 
that were necessary to prevent continued unauthorized access by the defendants 
and others whom they aided and abetted." 


While there is precedent in assigning damages for such things as "expenses 

for new computers and security devices that were necessary to prevent continued 
unauthorized access by the defendants and others whom they aided and abetted." 
(the Riggs, Darden & Grant case in Atlanta found that the defendants were 
liable for such expenses), many feel that such action is totally wrong. Ifa 
person is found uninvited in someone’s house, they are appropriately charged 
with unlawful entry, trespassing, burglary whatever the statute is for the 
transgression; he or she is, however, not charged with the cost of the 
installation of an alarm system or enhanced locks to insure that no other 
person unlawfully enters the hous 


When I discussed this point with a New York MIS manager, prone to take a strong 
anti-intruder position, he said that an outbreak of new crimes often results in 
the use of new technological devices such as the nationwide installation of 


metal detectors in airports in the 1970’s. While he meant this as a 
justification for liability, the analogy seems rather to support the contrary 
position. Air line hijackers were prosecuted for all sorts of major crimes; 


they were, however, never made to pay for the installation of the metal 
detectors or absorb the salary of the additional air marshalls hired to combat 
hijacking. 


I think the airline analogy also brings out the point that one may both support 
justifiable penalties for proven crimes and oppose unreasonable ones -- too 
often, when discussing these issues, observers choose one valid position to the 
unnecessary exclusion of another valid one. There is nothing contradictory, in 
my view, to holding both that credit agencies must be required to provide the 
highest possible level of security for data they have collected AND that 
persons invading the credit data bases, no matter how secure they are, be held 
liable for their intrusions. We are long past accepting the rationale that the 
intruders "are showing how insecure these repositories of our information are." 
We all know that the lack of security is scandalous; this fact, however, does 
not excuse criminal behavior (and it should seem evident that the selling of 
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electronic burglar tools so that someone may copy and sell credit reports is 
not a public service). 


The final point that requires serious scrutiny is the use of the indictment as 
a tool in the on-going political debate over the FBI Digital Telephony 
proposal. Announcing the indictments, Otto G. Obermaier, United States 
Attorney for the Southern District of New York, said that this investigation 
was "the first investigative use of court-authorized wiretaps to obtain 
conversations and data transmissions of computer hackers." He said that this 
procedure was essential to the investigation and that "It demonstrates, I 
think, the federal government’s ability to deal with criminal conduct as it 
moves into new technological areas." He added that the interception of data 
was possible only because the material was in analog form and added "Most of 
the new technology is in digital form and there is a pending statute in 
Congress which seeks the support of telecommunications companies to allow the 
federal government, under court authorization, to intercept digital 
transmission. Many of you may have read the newspaper about the laser 
transmission which go through fiber optics as a method of the coming 
telecommunications method. The federal government needs the help of Congress 
and, indeed, the telecommunications companies to able to intercept digital 
communications." 


The FBI proposal has been strongly attacked by the American Civil Liberties 
Union (ACLU), the Electronic Frontier Foundation (EFF) and Computer 
Professionals for Social Responsibility (CPSR) as an attempt to 
institutionalize, for the first time, criminal investigations as a 
responsibility of the communications companies; a responsibility that they feel 
belongs solely to law-enforcement. Critics further claim that the proposal 
will impede the development of technology and cause developers to have to 
"dumb-down" their technologies to include the requested interception 
facilities. The FBI, on the other hand, maintains that the request is simply 
an attempt to maintain its present capabilities in the face of advancing 
technology. 


Whatever the merits of the FBI position, it seems that the indictments either 
would not have been made at this time or, at a minimum, would not have been 
done with such fanfare if it were not for the desire to attempt to drum up 
support for the pending legislation. The press conference was the biggest 
thing of this type since the May 1990 "Operation Sun Devil" press conference in 
Phoenix, Arizona and, while that conference, wowed us with charges of "hackers" 
endangering lives by disrupting hospital procedures and being engaged ina 
nationwide, 13 state conspiracy, this one told us about a bunch of New York 
kids supposedly engaged in petty theft, using university computers without 
authorization and performing a number of other acts referred to by Obermaier as 


"anti-social behavior" -- not quite as heady stuff! 
It is not to belittle these charges they are quite serious -- to question 
the fanfare. The conference was attended by a variety of high level Justice 


Department, FBI and Secret Service personnel and veteran New York City crime 
reporters tell me that the amount of alleged damages in this case would 
normally not call for such a production -- New York Daily News reporter Alex 
Michelini publicly told Obermaier "What you’ve outlined, basically, except for 
the sales of credit information, this sounds like a big prank, most of it" 
(Obermaier’s respons "Well, I suppose you can characterize that as a prank, 
but it’s really a federal crime allowing people without authorization to 
rummage through the data of other people to which they do not have access and, 
as I point out to you again, the burglar cannot be your safety expert. He may 
be inside and laugh at you when you come home and say that your lock is not 
particularly good but I think you, if you were affected by that contact, would 
be somewhat miffed"). One hopes that it is only the fanfare surrounding the 
indictments that is tied in with the FBI initiative and not the indictments 
themselves. 


As an aside, two law enforcement people that I have spoken to have said that 
while the statement that the case is "the first investigative use of court-— 
authorized wiretaps to obtain conversations and data transmissions of computer 
h 

t 


ackers," while probably true, seems to give the impression that the case is 
he first one in which data transmission was intercepted. According to these 
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sources, that is far from the cas there have been many instances of 
inception of data and fax information by law enforcement officials in recent 
years. 


I know each of the accused in varying degrees. The one that I know the best, 
Phiber Optik, has participated in panels with myself and law enforcement 
officials discussing issues relating to so-called "hacker" crime. He has also 
appeared on various radio and television shows discussing the same issues. His 
high profile activities have made him an annoyance to some in law enforcement. 
One hopes that this annoyance played no part in the indictment. 


I have found Phiber’s presenc xtremely valuable in these discussions both for 
the content and for the fact that his very presence attracts an audience that 
might never otherwise get to hear the voices of Donald Delaney, Mike Godwin, 
Dorothy Denning and others addressing these issues from quite different vantage 
points. While he has, in these appearances, said that he has "taken chances to 
learn things", he has always denied that he has engaged in vandalous behavior 
and criticized those who do. He has also called those who engage in "carding" 
and the like as criminals (These statements have been made not only in the 
panel discussion, but also on the occasions that he has guest lectured to my 
class in "Connectivity" at the New School For Social Research in New York City. 
rT 

W 


n those classes, he has discussed the history of telephone communications in a 
ay that has held a class of professionals enthralled by over two hours. 


While my impressions of Phiber or any of the others are certainly not a 
guarantee of innocence on these charges, they should be taken as my personal 
statement that we are not dealing with a ring of hardened criminals that one 
would fear on a dark night. 


In summary, knee-jerk reactions should be out and thoughtful analysis in! We 
should be insisting on appropriate punishment for lawbreakers -- this means 
neither winking at "exploration" nor allowing inordinate punishment. We should 
be insisting that companies that have collected data about us properly protect 
-- and are liable for penalties when they do not. We should not be deflected 
from this analysis by support or opposition to the FBI proposal before Congress 
-- that requires separate analysis and has nothing to do with the guilt or 
innocence of these young men or the appropriate punishment should any guilt be 
established. 


New York Hackers Plead Not Guilty July 17, 1992 
New York City -- At an arraignment in New York Federal Court on Thursday, July 
16th, the five New York "hackers," recently indicted on charges relating to 
alleged computer intrusion, all entered pleas of not guilty and were released 
after each signed a personal recognizance (PRB) bond of $15,000 to guarantee 
continued appearances in court. 


As part of the arraignment process, United States District Judge Richard Owen 
was assigned as the case’s presiding judge and a pre-trial meeting between the 
judge and the parties involved. 


Charles Ross, attorney for John Lee, told Newsbytes "John Lee entered a not 
guilty plea and we intend to energetically and aggressively defend against the 
charges made against him." 


Ross also explained the procedures that will be in effect in the case, saying 
"We will meet with the judge and he will set a schedule for discovery and the 
filing of motions. The defense will have to review th vidence that the 
government has amassed before it can file intelligent motions and the first 
meeting is simply a scheduling one." 


Majorie Peerce, attorney for Stira, told Newsbytes "Mr. Stira has pleaded not 
guilty and will continue to plead not guilty. I am sorry to s the government 
indict a 22 year old college student for acts that he allegedly committed as a 
19 year old." 


The terms of the PRB signed by the accused require them to remain within the 
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continental United States. In requesting the bond arrangement, Assistant 
United States Attorney Stephen Fishbein referred to the allegations as serious 
and requested the $15,000 bond with the stipulation that the accused have their 
bonds co-signed by parents. Abene, Fernandez and Lee, through their attorneys, 
agreed to the bond as stipulated while the attorneys for Ladopoulos and Stira 
requested no bail or bond for their clients, citing the fact that their clients 
have been available, when requested by authorities, for over a year. After 
consideration by the judge, the same $15,000 bond was set for Ladopoulos and 
Stira but no co-signature was required. 


Young Working-Class Hackers Accused of High-Tech Crime July 23, 1992 


By Mary B.W. Tabor with Anthony Ramirez (The New York Times) (Page Bl, B7) 
Computer Savvy, With an Attitude 


Late into the night, in working-class neighborhoods around New York City, young 
men with code names like Acid Phreak and Outlaw sat hunched before their 
glowing computer screens, exchanging electronic keys to complex data-processing 
systems. They called themselves the Masters of Deception. Their mission: to 
prove their prowess in the shadowy computer underworld. 


Compulsive and competitive, they played out a cybernetic version of "West Side 
Story," trading boasts, tapping into telephone systems, even pulling up 
confidential credit reports to prove their derring-do and taunt other hackers. 
Their frequent target was the Legion of Doom, a hacker group named after a 
gang of comic-book villains. The rivalry seemed to take on class and ethnic 
overtones, too, as the diverse New York group defied the traditional image of 
the young suburban computer whiz. 


But Federal prosecutors say the members of MOD, as the group called itself, 
went far beyond harmless pranks. 


Facing Federal Charges 
n July 16, five young men identified by prosecutors as MOD members pleaded not 


O 
guilty to Federal charges including breaking into some of the nation’s most 
powerful computers and stealing confidential data like credit reports, some of 
W 

m 


hich were later sold to private investigators. Prosecutors call it one of the 
ost extensive thefts of computer information ever reported. 


The indictment says the men entered the computer systems of Southwestern Bell, 
TRW Information Services and others "to enhance their image and prestige among 
other computer hackers; to harass and intimidate rival hackers and other people 
they did not like; to obtain telephone, credit, information and other services 
without paying for them; and to obtain passwords, account numbers and other 
things of value which they could sell to others." 


With modems that link their terminals to other computers over ordinary 

telephone lines, young hackers have been making mischief for years. But as the 
nation relies more and more on vast networks of powerful computers and as 
personal computers become faster and cheaper, the potential for trouble has 
soared. For example, Robert Tappan Morris, a Cornell student, unleashed a 
program in 1988 that jammed several thousand computers across the country. 


A Polyglot Group 


But the world of computer hackers has been changing. Unlike the typical 


hackers of old -- well-to-do suburban youths whose parents could afford costly 
quipment the Masters of Deception are a polyglot representation of blue- 
collar New York: black, Hispanic, Greek, Lithuanian and Italian. They work 
their mischief often using the least expensive computers. 


One of the young men, 21-year-old John Lee, who goes by the name Corrupt, has 
dreadlocks chopped back into stubby "twists," and lives with his mother in a 
dilapidated walk-up in Bedford-Stuyvesant, Brooklyn. He bounced around 

programs for gifted students before dropping out of school in the 11th grade. 
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Scorpion -- 22-year-old Paul Stira of Queens -- was his class valedictorian at 
Thomas A. Edison High School in Queens. Outlaw -- Julio Fernandez, 18, of the 
Bronx -—- first studied computers in grade school. 


They met not on street corners, but via computer bulletin boards used to swap 
messages and programs. 


With nothing to identify them on the boards except their nicknames and uncanny 
abilities, the young men found the computer the great democratic leveler. 


Questions of Profit 


There may be another difference in the new wave of hackers. While the 
traditional hacker ethic forbids cruising computer systems for profit, some new 
hackers are less idealistic. "People who say that," said one former hacker, a 
friend of the MOD who insisted on anonymity, "must have rich parents. When you 
get something of value, you’ve got to make money." 


Mr. Lee, Mr. Fernandez, Mr. Stira and two others described as MOD members --— 
20-year-old Mark Abene (Phiber Optik), and 22-year-old Elias Ladopoulos (Acid 
Phreak), both of Queens -- were charged with crimes including computer 
tampering, computer and wire fraud, illegal wiretapping and conspiracy. They 
face huge fines and up to five years in prison on each of 11 counts. 


The youths, on advice of their lawyers, declined to be interviewed. 


Prosecutors say they do not know just how and when youthful pranks turned to 
serious crime. Other hackers said the trouble began, perhaps innocently 
enough, as a computer war with ethnic and class overtones. 


The Masters of Deception were born in a conflict with the Legion of Doom, which 
had been formed by 1984 and ultimately included among its ranks three Texans, 
one of whom, Kenyon Shulman, is the son of a Houston socialite, Carolyn Farb. 


Banished From the Legion 


Mr. Abene had been voted into the Legion at one point. But when he began to 
annoy others in the group with his New York braggadocio and refusal to share 
information, he was banished, Legion members said. 


Meanwhile, a hacker using a computer party line based in Texas had insulted Mr. 
Lee, who is black, with a racial epithet. 


By 1989, both New Yorkers had turned to a new group, MOD, founded by Mr. 
Ladopoulos. They vowed to replace their Legion rivals as the "new elite." 


"It’s like every other 18- or 19-year-old who walks around knowing he can do 
something better than anyone else can," said Michael Godwin, who knows several 
of the accused and is a lawyer for the Electronic Frontier Foundation of 
Cambridge, Massachusetts, which provides legal aid for hackers. "They are 
offensively arrogant." 


Hacker groups tend to rise and fall within six months or so as members leave 
for college, meet girls or, as one former hacker put it, "get a life." But the 
MOD continued to gather new members from monthly meetings in the atrium of the 
Citicorp Building in Manhattan and a computer bulletin board called Kaos. 
According to a history the group kept on the computer network, they enjoyed 
"mischievous pranks," often aimed at their Texas rivals, and the two groups 
began sparring. 


Texas-New York Sparring 


But in June 1990, the thr Texas-based Legion members, including Mr. Shulman, 
Chris Goggans and Scott Chasin, formed Comsec Data Security, a business 
intended to help companies prevent break-ins by other hackers. 


Worried that the Texans were acting as police informers, the MOD members 
accused their rivals of defaming them on the network bulletin boards. Several 
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members, including Mr. Abene, had become targets of raids by the Secret 
Service, and MOD members believed the Texans were responsible, a contention the 
Texans respond to with "no comment." 


But the sparring took on racial overtones as well. When Mr. Lee wrote a 
history of the MOD and left it in the network, Mr. Goggans rewrote it in a jive 
parody. 


The text that read, "In the early part of 1987, there were numerous amounts of 
busts in the U.S. and in New York in particular" became "In de early time part 
uh 1987, dere wuz numerous amounts uh busts in de U.S. and in New Yo’k in 
particular." 


Mr. Goggans said that it was not meant as a racist attack on Mr. Lee. "It was 
just a good way to get under his skin," he said. 


Exposing Identities 


MOD’s activities, according to the indictment and other hackers, began to 
proliferate. 


Unlike most of the "old generation" of hackers who liked to joyride through the 
systems, the New Yorkers began using the file information to harass and 


intimidate others, according to prosecutors. Everything from home addresses to 
credit card numbers to places of employment to hackers’ real names -- perhaps 
the biggest taboo of all -- hit the network. 


In the indictment, Mr. Lee and Mr. Fernandez are accused of having a 
conversation last fall in which they talked about getting information on how to 
alter TRW credit reports to "destroy people’s lives or make them look like 
saints." 


The prosecutors say the youths also went after information they could sell, 
though the indictment is not specific about what, if anything, was sold. The 
only such information comes from another cas arlier this month in which two 
other New York City hackers, Morton Rosenfeld, 21, of Brooklyn, and Alfredo de 
la Fe, 18, of Manhattan, pleaded guilty to a conspiracy to use passwords and 
other access devices obtained from MOD. They said they had paid "several 
hundred dollars" to the computer group for passwords to obtain credit reports 
and then resold the information for "several thousand dollars" to private 
investigators. 


News Media Attention 

Competition for attention from the news media also heated up. The former 
Legion members in Comsec had become media darlings, with articles about them 
appearing in Time and Newsweek. Mr. Abene and Mr. Ladopoulos also appeared on 
television or in magazines, proclaiming their right to probe computer systems, 
as long as they did no damage. 


In one highly publicized incident, during a 1989 forum on computers and privacy 
sponsored by Harper’s magazine, John Perry Barlow, a freelance journalist and 
lyricist for the Grateful Dead, went head to head with Mr. Abene, or Phiber 
Optik. Mr. Barlow called the young hacker a "punk." 


According to an article by Mr. Barlow -- an account that Mr. Abene will not 
confirm or deny -- Mr. Abene then retaliated by "downloading" Mr. Barlow’s 
credit history, displaying it on the computer screens of Mr. Barlow and other 
network users. 


Skirmishes Subside 


"I’ve been in redneck bars wearing shoulder-length curls, police custody while 
on acid, and Harlem after midnight, but no one has ever put the spook in me 
quite as Phiber Optik did at that moment," Mr. Barlow wrote. "To a middle- 
class American, one’s credit rating has become nearly identical to his 
freedom." 
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In recent months, hackers say, the war has calmed down. Comsec went out of 
business, and several Masters of Deception were left without computers after 
the Secret Service raids. 


Mr. Abene pleaded guilty last year to misdemeanor charges resulting from the 
raids. On the night before his arrest this month, he gave a guest lecture on 
computers at the New School for Social Research. 


Mr. Lee says he works part time as a stand-up comic and is enrolled at Brooklyn 
College studying film production. 


Mr. Stira is three credits shy of a degree in computer science at Polytechnic 
University in Brooklyn. Mr. Fernandez hopes to enroll this fall in the 
Technical Computer Institute in Manhattan. Mr. Ladopoulos is studying at 
Queens Community College. 


No trial date has been set. 


But the battles are apparently not over yet. A couple of days after the 
charges were handed up, one Legion member said, he received a message on his 
computer from Mr. Abene. It was sarcastic as usual, he said, and it closed, 
"Kissy, kissy." 


= 


Editor’s Note: Article included photographs of Phiber Optik, Scorpion, 
Corrupt, and Outlaw. ] 


Frustrated Hackers May Have Helped Feds In MOD Sting July 20, 1992 


By James Daly (ComputerWorld) (Page 6) 


NEW YORK Are hackers beginning to police themselves? The five men recently 
charged with cracking into scores of complex computer systems during the last 
two years may have been fingered by other hackers who had grown weary of the 
group’s penchant for destruction and vindictiveness, members of the hacker 
community said. 


The arrest of the defendants, whom federal law enforcement officials claimed 
were members of a confederation variously called the "Masters of Deception" and 
the "Masters of Disaster" (MOD), was cause for celebration in some quarters 
where the group is known as a spiteful fringe element. 


"Some of these guys were a big pain," said one source who requested anonymity 
for fear that unindicted MOD members would plot revenge. "They used their 
skills to harass others, which is not what hacking is all about. MOD came with 
a ‘'you will respect us’ attitude, and no one liked it." 


Said another: "In the past few months, there has been a lot of muttering on the 
[bulletin] boards about these guys." 


In one episode, MOD members reportedly arranged for the modem of a computer at 
the University of Louisville in Kentucky to continually dial the home number of 
a hacker bulletin board member who refused to grant them greater access 
privileges. A similar threat was heard in Maryland. 


In the indictment, the defendants are accused of carrying on a conversation in 
early November 1991 in which they sought instructions on how to add and remove 
credit delinquency reports "to destroy people’s lives . . . or make them look 
like a saint." Unlike many other hacker organizations, the members of MOD 
agreed to share important computer information only among themselves and not 
with other hackers. 


Officials Mum 


Who exactly helped the FBI, Secret Service and U.S. Attorney General’s Office 
prepare a case against the group is still anyone’s guess. Assistant U.S. 
Attorney Stephen Fishbein is not saying. He confirmed that the investigation 
into the MOD began in 1990, but he would not elaborate on how or why it was 
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launched or who participated. FBI and Secret Service officials were equally 
mute. 


Some observers said that if the charges are true, the men were not true 
"hackers" at all. 


"Hacking is something done in the spirit of creative playfulness, and people 


who break into computer security systems aren’t hackers they’ re criminals," 
said Richard Stallman, president of the Cambridge, Massachusetts-based Fr 
Software Foundation, a public charity that develops free software. The 


foundation had several files on one computer deleted by a hacker who some 
claimed belonged to the MOD. 


The MOD hackers are charged with breaking into computer systems at several 
regional telephone companies, Fortune 500 firms including Martin Marietta 
Corp., universities and credit-reporting concerns such as TRW, Inc., which 
reportedly had 176 consumer credit reports stolen and sold to private 
investigators. The 1l-count indictment accuses the defendants of computer 
fraud, computer tampering, wire fraud, illegal wiretapping and conspiracy. 


But some hackers said the charges are like trying to killing ants with a 
sledgehammer. "These guys may have acted idiotically, but this was a stupid 
way to get back at them," said Emmanuel Goldstein, editor of 2600, a quarterly 
magazine for the hacker community based in Middle Island, New York. 


Longtime hackers said the MOD wanted to move into the vacuum left when the 
Legion of Doom began to disintegrate in late 1989 and early 1990 after a series 
of arrests in Atlanta and Texas. Federal law enforcement officials have 
described the Legion of Doom as a group of about 15 computer enthusiasts whose 
members re-routed calls, stole and altered data and disrupted telephone 
services. 
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Bellcore Threatens 2600 Magazine With Legal Action July 15, 1992 
THE FOLLOWING CERTIFIED LETTER HAS BEEN RECEIVED BY 2600 MAGAZINE. WE WELCOM 
ANY COMMENTS AND/OR INTERPRETATIONS. 


[7] 
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Leonard Charles Suchyta 
General Attorney 
Intellectual Property Matters 


Emanuel [sic] Golstein [sic], Editor 
2600 Magazine 

P.O. Box 752 

Middle Island, New York 11953-0752 


Dear Mr. Golstein: 


It has come to our attention that you have somehow obtained and published in 
the 1991-1992 Winter edition of 2600 Magazine portions of certain Bellcore 
proprietary internal documents. 


This letter is to formally advise you that, if at any time in the future you 
(or your magazine) come into possession of, publish, or otherwise disclose any 
Bellcore information or documentation which either (i) you have any reason to 
believe is proprietary to Bellcore or has not been made publicly available by 
Bellcore or (ii) is marked "proprietary," "confidential," "restricted," or with 
any other legend denoting Bellcore’s proprietary interest therein, Bellcor 

will vigorously pursue all legal remedies available to it including, but not 
limited to, injunctive relief and monetary damages, against you, your magazine, 
and its sources. 


We trust that you fully understand Bellcore’s position on this matter. 


Sincerely, 


LCS/sms 


LCS/CORR/JUN92/golstein. 619 


Emmanuel Goldstein Responds 


The following reply has been sent to Bellcore. Since we believe they hav 
received it by now, we are making it public. 


Emmanuel Goldstein 
Editor, 2600 Magazine 
PO Box 752 

Middle Island, NY 11953 


July 20, 1992 
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Leonard Charles Suchyta 
CC 2E-311 
290 W. Mt. Pleasant Avenue 
Livingston, NJ 07039 


Dear Mr. Suchyta: 


We are sorry that the information published in the Winter 1991-92 issue of 2600 
disturbs you. Since you do not specify which article you take exception to, we 
must assume that you’re referring to our revelation of built-in privacy holes 
in the telephone infrastructure which appeared on Page 42. In that piece, we 
quoted from an internal Bellcore memo as well as Bell Operating Company 
documents. This is not the first time we have done this. It will not be the 
last. 


We recognize that it must be troubling to you when a journal like ours 
publishes potentially embarrassing information of the sort described above. 

But as journalists, we have a certain obligation that cannot be cast aside 
every time a large and powerful entity gets annoyed. That obligation compels 
us to report the facts as we know them to our readers, who have a keen interest 
in this subject matter. If, as is often the case, documents, memoranda, and/or 
bits of information in other forms are leaked to us, we have every right to 
report on the contents therein. If you find fault with this logic, your 
argument lies not with us, but with the general concept of a free press. 


And, as a lawyer specializing in intellectual property law, you know that you 
cannot in good faith claim that merely stamping "proprietary" or "secret" on a 
document establishes that document as a trade secret or as proprietary 
information. In the absence of a specific explanation to the contrary, we must 
assume that information about the publicly supported telephone system and 
infrastructure is of public importance, and that Bellcore will have difficulty 
establishing in court that any information in our magazine can benefit 
Bellcore’s competitors, if indeed Bellcore has any competitors. 


If in fact you choose to challenge our First Amendment rights to disseminate 
important information about the telephone infrastructure, we will be compelled 
to respond by seeking all legal remedies against you, which may include 
sanctions provided for in Federal and state statutes and rules of civil 
procedure. We will also be compelled to publicize your use of lawsuits and the 
threat of legal action to harass and intimidate. 


Sincerely, 


Emmanuel Goldstein 


Exposed Hole In Telephone Network Draws Ire Of Bellcor July 24, 1992 


Anyone Can Wiretap Your Phone 


Major security hol in telephone network creates "self-serve" monitoring 
feature allowing anyone to listen in on any telephone conversation they choose. 
Weakness involves feature called Busy Line Verification (BLV), which allows 


phone companies to "break into" conversation at any time. BLV is used most 
often by operators entering conversation to inform callers of emergency 
message. But BLV feature can be used by anyone with knowledge of network’s 


weakness to set up ad hoc ‘/wiretap’ and monitor conversations, said Emmanuel 
Goldstein, editor of 2600 Magazine, which published article in its Winter 1991 
issue. 


2600 Magazine is noted for finding and exposing weaknesses of 
telecommunications. It’s named for frequency of whistle, at one time given 
away with Cap’n Crunch cereal, which one notorious hacker discovered could, 
when blown into telephone receiver, allow access to open 800 line. Phone 
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companies have since solved that problem. 


Security risks are outlined in article titled "U.S. Phone Companies Face Built- 
In Privacy Hole" that quotes from internal Bellcore memo and Bell Operating Co. 
documents: "’A significant and sophisticated vulnerability’ exists that could 
affect the security and privacy of BLV." Article details how, after following 4 
steps, any line is susceptible to secret monitoring. One document obtained by 
2600 said: "There is no proof the hacker community knows about the 
vulnerability." 


When Bellcore learned of article, it sent magazine harsh letter threatening 
legal action. Letter said that if at any time in future magazine "comes into 
possession of, publishes, or otherwise discloses any Bellcore information" 
organization will "vigorously pursue all legal remedies available to it 
including, but not limited to, injunctive and monetary damages." Leonard 
Suchyta, Bellcore General Attorney for Intellectual Property Matters, said 
documents in magazine’s possession "are proprietary" and constitute "a trade 
secret" belonging to Bellcore and its members -- RBOCs. He said documents are 
"marked with ’Proprietary’ legend" and "the law says you can’t ignore this 
legend, its [Bellcore’s] property." Suchyta said Bellcore waited so long to 
respond to publication because "I think the article, as we are not subscribers, 
was brought to our attention by a 3rd party." He said this is first time he 
was aware that magazine had published such Bellcore information. 


But Goldstein said in reply letter to Bellcore: "This is not the first time we 
have done this. It will not be the last." He said he thinks Bellcore is 
trying to intimidate him, "but they’ve come up against the wrong publication 
this time." Goldstein insisted that documents were leaked to his magazine: 
"While we don’t spread the documents around, we will report on what’s contained 
within." Suchyta said magazine is obligated to abide by legend stamped on 
documents. He said case law shows that the right to publish information hinges 
on whether it "has been lawfully acquired. If it has a legend on it, it’s sort 
of hard to say it’s lawfully acquired." 


Goldstein said he was just making public what already was known: There’s known 
privacy risk because of BLV weakness: "If we find something out, our first 
instinct is to tell people about it. We don’t keep things secret." He said 
information about security weaknesses in phone network "concerns everybody." 
Just because Bellcore doesn’t want everyone to know about its shortcomings and 
those of telephone network is hardly reason to stifle that information, 
Goldstein said. “Everybody should know if their phone calls can be listened in 
on." 


Suchyta said that to be considered "valuable," information "need not be of 
super, super value," like proprietary software program "where you spent 
millions of dollars" to develop it. He said information "could well be your 
own information that would give somebody an advantage or give them some added 
value they wouldn’t otherwise have had if they had not taken it from you." 
Goldstein said he was "sympathetic" to Bellcore’s concerns but "fact is, even 
when such weaknesses ar xposed, [phone companies] don’t do anything about 


them." He cited recent indictments in New York where computer hackers were 
manipulating telephone, exploiting weaknesses his magazine had profiled long 
ago. "Is there any security at all [on the network]?" he said. "That’s the 


question we have to ask ourselves." 


Letter from Bellcore drew burst of responses from computer community when 
Goldstein posted it to electronic computer conference. Lawyers specializing in 
computer law responded, weighing in on side of magazine. Attorney Lance Rose 
said: "There is no free-floating /’/secrecy’ right .. . Even if a document says 
‘confidential’ that does not mean it was disclosed to you with an understanding 
of confidentiality -- which is the all-important question." Michael Godwin, 
general counsel for Electronic Frontier Foundation, advocacy group for the 
computer community, said: "Trade secrets can qualify as property, but only if 


they’re truly trade secrets. Proprietary information can (sort of) qualify as 
property if there’s a breach of a fiduciary duty." Both lawyers agreed that 
magazine was well within its rights in publishing information. "If Emmanuel 


did not participate in any way in encouraging or aiding in the removal of the 
document from Bellcore . .. that suggests he wouldn’t be liable," Godwin said. 
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Bellcore And 2600 Dispute Publishing Of Article 


By 


July 27, 1992 


Barbara E. McMullen & John F. McMullen (Newsbytes) 


MIDDLE ISLAND, NY -- Eric Corley a/k/a "Emmanuel Goldstein", editor and 


pub 
wil 


considers important for his readership. 


Ear 


lisher of 2600 Magazine: The Hacker Quarterly, has told Newsbytes that he 
1 not be deterred by threats from Bellcore from 


publishing material which he 


ier this month, Corley received a letter (addressed to "Emanuel Golstein") 


from Leonard Charles Suchyta, General Attorney, Intellectual Property Matters 
at Bellcore taking issue with the publication by 2600 of material that Suchyta 
referred to as "portions of certain Bellcore proprietary internal documents." 


The letter continued "This letter is to formally advise you that, if at any 
time in the future you (or your magazine) come into possession of, publish, or 


otherwise disclose any Bel 


you 
pub 


llcore information or documentation which either (i) 


have any reason to believe is proprietary to Bellcore or has not been made 


icly available by Bellcore or (ii) is marked "proprietary," "confidential," 


"restricted," or with any other legend denoting Bellcore’s proprietary interest 


therein, Bellcore will vigorously pursue all legal 


inc 


Whi 
Cor 
a 
fe) 


remedies available to it 


luding, but not limited to, injunctive relief and monetary damages, against 
you, your magazine, and its sources." 


le the letter did not mention any specific material published by 2600, 
ley told Newsbytes that he believes that Suchyta’s letter refers to an 
rticle entitled "U.S. Phone Companies Face Built-In Privacy Hole".that appears 
n page 42 of the Winter 1991 issue. 
derived from a 1991 internal Bellcore memo as well 


Corley said "What we published was 


as Bell Operating Company 


documents that were leaked to us. We did not publish the documents. However, 
we did read what was sent to us and wrote an article based upon that. The 


story focuses on how the phone companies are in an 


and 


ne 


mals 
MD: 
3.0 


WA. 


"By 


The 
the 


He 
eS 
While the phone 
discovered self-serv 


sophisticated vulnerability’ that could result 


verification) being used to listen in on phone call 


650-word article said, in part, "By exploiting 


uproar over a ’significant 
in BLV (busy line 
‘GL AN 


a weakness, it’s possible 


o remotely listen in on phone conversations at a selected telephone number. 
companies can do this any time they want, this recently 
monitoring feature has created a telco crisis of sorts." 


The article further explained how people might exploit the security hole, 
saying "The intruder can listen in on phone call 
steps: 


ls by following these four 


Query the switch to determine the Routing Class Code assigned to the BLV 


trunk group. 


Find a vacant telephone number served by that switch. 
Via recent change, assign the Routing Class Code of the BLV trunks to the 


Chart Column value of the DN (directory number) 
number. 


of the vacant telephone 


Add call forwarding to the vacant telephone number (Remote Call Forwarding 


would allow remote definition of the target telephone number while Call 
Forwarding Fixed would only allow the specification of one target per 


recent change message or vacant line)." 


calling the vacant phone number, the intruder would get routed to the BLV 
trunk group and would then be connected on a "no-test vertical" to the target 
phone line in a bridged connection." 


article added "According to one of the documents, there is no proof that 


hacker community knows about the vulnerability. 


The authors did express 


great concern over the publication of an articl ntitled ’Central Office 
Operations - The End Office Environment’ which appeared in the electronic 


newsletter Legion of Doom/Hackers 


reference is made to the ’No Test Trunk’." 


Technical Journal. In this article, 
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The article concludes "even if hackers are denied access to this "feature", 
BLV networks will still have the capability of being used to monitor phone 
lines. Who will be monitored and who will be listening are two forever 


unanswered questions." 


Corley responded to to Suchyta’s letter on July 20th, saying "I assume that 
you're referring to our revelation of built-in privacy holes in the telephone 
infrastructure which appeared on Page 42. In that piece, we quoted from an 
internal Bellcore memo as well as Bell Operating Company documents. This is 
not the first time we have done this. It will not be the last. 


"We recognize that it must be troubling to you when a journal like ours 
publishes potentially embarrassing information of the sort described above. 

But as journalists, we have a certain obligation that cannot be cast aside 
every time a large and powerful entity gets annoyed. That obligation compels 
us to report the facts as we know them to our readers, who have a keen interest 
in this subject matter. If, as is often the case, documents, memoranda, and/or 
bits of information in other forms are leaked to us, we have every right to 
report on the contents therein. If you find fault with this logic, your 
argument lies not with us, but with the general concept of a free press. 


"And, as a lawyer specializing in intellectual property law, you know that 

you cannot in good faith claim that merely stamping "proprietary" or "secret" 
on a document establishes that document as a trade secret or as proprietary 
information. In the absence of a specific explanation to the contrary, we must 
assume that information about the publicly supported telephone system and 
infrastructure is of public importance, and that Bellcore will have difficulty 
establishing in court that any information in our magazine can benefit 
Bellcore’s competitors, if indeed Bellcore has any competitors. 


"If in fact you choose to challenge our First Amendment rights to disseminate 
important information about the telephone infrastructure, we will be compelled 
to respond by seeking all legal remedies against you, which may include 
sanctions provided for in Federal and state statutes and rules of civil 
procedure. We will also be compelled to publicize your use of lawsuits and the 
threat of legal action to harass and intimidate. 


Sincerely, 
Emmanuel Goldstein" 


Corley told Newsbytes "Bellcore would never have attempted this with the New 
York Times. They think that it would, however, be easy to shut us up by simple 
threats because of our size. They are wrong. We are responsible journalists; 
we know the rules and we abide by them. I will, by the way, send copies of the 
article in question to anyone who request it. Readers may then judge for 
themselves whether any boundaries have been crossed." 


Corley, who hosts the weekly "Off the Hook" show on New York City’s WBAI radio 
station, said that he had discussed the issue on the air and had received 


universal support from his callers. Corley also told Newsbytes, that, although 
he prefers to be known by his nomme de plume (taken from George Orwell’s 
1984), he understands that the press fells bound to use his actual name. de 


said that, in the near future, he will "end the confusion by having my name 
legally changed." 


Bellcore personnel were unavailable for comment on any possible response to 
Corley’s letter. 


Interview With Ice Man And Maniac July 22, 1992 


By Joshua Quittner (New York Newsday) (Page 83) 


Ice Man and Maniac are two underground hackers in the New England area that 
belong to a group known as Micro Pirates, Incorporated. They agreed to be 
interviewed if their actual identities were not revealed. 
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[Edi 


Oe 4H: 


Mani 


Os oA 


tor’s Note: They are fools for doing this, especially in light of how 
Phiber Optik’s public media statements and remarks will 
ultimately be used against him. ] 
ow do you define computer hacking? 
ac: Hacking is not exploration of computer systems. It’s more of an 
undermining of security. That’s how I see it. 
ow many people are in your group, Micro Pirates Incorporated? 


Ice Man: Fifteen or 14. 


Mani 


ac: We stand for similar interests. It’s an escape, you know. If I’m not 
doing well in school, I sit down on the board and talk to some guy in 
West Germany, trade new codes of their latest conquest. Escape. 
Forget about the real world. 


Ice Man. It’s more of a hobby. Why do it? You can’t exactly stop. I came 


QO: Y 


about a year-and-a-half ago, and I guess you could say I’m one of the 
ones on a lower rung, like in knowledge. I do all the -- you wouldn’t 
call it dirty work -- phone calls. I called you -- that kind of 
thing. 


ou’re a "Social engineer"? 


Ice Man: Social engineering I don’t know who coined the term. It’s using 


QO: W 


Mani 


conversation to exchange information under false pretenses. For 
example, posing as a telecommunications employee to gain more 
knowledge and insight into the different [phone network] systems. 


hat social engineering have you done? 


ac: We hacked into the system that keeps all the grades for the public 
school system. It’s the educational mainframe at Kingsborough 
Community College. But we didn’t change anything. 


Ice Man: They have the mainframe that stores all the schedules, Regents scores, 


Ox. 


Ice 


Ocrk 


Ice 


Ice 


QO: W 
Mani 
Oke 


ID numbers of all the students in the New York high school area. You 
have to log in as a school, and the password changes every week. 


ow did you get the password? 

Man: Brute force and social engineering. I was doing some social 
engineering in school. I was playing the naive person with an 
administrator, asking all these questions toward what is it, where is 
it and how do you get in. 

bet you looked at your grades. How did you do? 
Man: High 80s. 


nd you could have changed Regents scores? 

Man: I probably wouldn’t have gotten away with it, and I wouldn’t say I 
chose not to on a moral basis. I’d rather say on a security basis. 

hat is another kind of social engineering? 

ac: There’s credit-card fraud and calling-card fraud. You call up and 
say, "I’m from the AT&T Corporation. We’re having trouble with your 
calling-card account. Could you please reiterate to us your four- 
digit PIN number?" People, being kind of God-fearing -- as AT&T is 
somewhat a God -- will say, "Here’s my four-digit PIN number." 

Hackers from another group, MOD, were arrested recently and charged with, 


among other things, selling inside information about how to penetrate 
credit bureaus. Have you cleaned up your act? 
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Maniac: We understand the dangers of it now. We’re not as into it. We 
understand what people go through when they find out a few thousand 
dollars have been charged to their credit-card account. 


Q: Have you hacked into credit bureaus? 


Ice Man: We were going to look up your name. 


Maniac: CBI [Credit Bureau International, owned by Equifax, one of the largest 
national credit bureaus], is pretty insecure, to tell you the truth. 


Q: Are you software pirates, too? 
Maniac: Originally. Way back when. 


Ice Man: And then we branched out and into the hacking area. Software piracy 
is, in the computer underground, the biggest thing. There are groups 
like THG and INC, which are international. THG is The Humble Guys. 
INC is International Network of Crackers, and I’ve recently found out 
that it’s run by 14 and 15-year-olds. They have people who work in 
companies, and they’1ll take the software and they’1ll crack it -- the 
software protection -- and then distribute it. 


Q: Are there many hacking groups in New York? 


Maniac: Three or four. LOD [the Legion of Doom, named by hacker Lex Luthor], 
MOD, MPI and MOB [Men of Business]. 


Q: How do your members communicate? 


Ice Man: The communication of choice is definitely the modem [to access 
underground electronic bulletin boards where members leave messages 
for each other or "chat" in real time]. After that is the voice mail 
box [VMB]. VMBs are for communications between groups. 


A company, usually the same company that has beepers and pagers and 
answering services, has a voice-mail-box service. You call up [after 
hacking out an access code that gives the user the ability to create 
new voice mail boxes on a system] and can enter in a VMB number. 
Occasionally they have outdial capabilities that allow you to call 
anywhere in the world. I call about five every day. It’s not really 
my thing. 


Q: Is your group racially integrated? 


Ice Man: Half of them are Asian. Also we have, I think, one Hispanic. I never 
met him. Race, religion -- nobody cares. The only thing that would 
alienate you in any way would be if you were known as a lamer. If you 


just took, took, took and didn’t contribute to the underground. It’s 
how good you are, how you’re respected. 


Maniac: We don’t work on a racial basis or an ethnic basis. We work ona 
business basis. This is an organized hobby. You do these things for 
us and you get a little recognition for it. 


Ice Man: Yeah. If you’re a member of our group and you need a high-speed 
modem, we’ll give you one, on a loan basis. 


Q: How does somebody join MPI? 
Maniac: They have to contact either of us on the boards. 


Ice Man: And I’1l1 go through the whole thing [with them], validating them, 
checking their references, asking them questions, so we know what 
they’re talking about. And if it’s okay, then we let them in. We 
have members in 516, 718, 212, 201, 408, and 908. We’re talking to 
someone in Florida, but he’s not a member yet. 
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Q: Are any MPI members in other hacking groups? 


Ice Man: I know of no member of MPI that is in any other group. I wouldn’t 
call it betrayal, but it’s like being in two secret clubs at one time. 
I would want them faithful to my group, not any other group. There is 
something called merging, a combination of both groups that made them 
bigger and better. A lot of piracy groups did that. 


Q: Aren’t you concerned about breaking the law? 


Maniac: Breaking the law? I haven’t gotten caught. If I do get caught, I 
won’t be stupid and say I was exploring -- I’m not exploring. I’m 
visiting, basically. If you get caught, you got to serve your time. 
I’m not going to fight it. 


FBI Unit Helps Take A Byte Out Of Crime July 15, 1992 


By Bill Gertz (The Washington Times) (Page A4) 


FBI crime busters are targeting elusive computer criminals who travel the world 
by keyboard, telephone and computer screen and use such code names as "Phiber 
Optik," "Masters of Disaster," "Acid Phreak" and "Scorpion." 


"Law enforcement across the board recognizes that this is a serious emerging 
crime problem, and it’s only going to continue to grow in the future," said 
Charles L. Owens, chief of the FBI’s economic crimes unit. 


Last week in New York, federal authorities unsealed an indictment against five 
computer hackers, ages 18 to 22, who were charged with stealing long-distance 
phone service and credit bureau information and who penetrated a wide variety 
of computer networks. 


The FBI is focusing its investigations on major intrusions into banking and 
government computers and when the objective is stealing money, Mr. Owens said 
in an interview. 


FBI investigations of computer crimes have doubled in the past year, he said, 
adding that only about 11 percent to 15 percent of computer crimes are reported 
to law enforcement agencies. Because of business or personal reasons, victims 
often are reluctant to come forward, he said. 


Currently, FBI agents are working on more than 120 cases, including at least 
one involving a foreign intelligence agency. Mr. Owens said half of the active 
cases involve hackers operating overseas, but he declined to elaborate. 


he FBI has set up an eight-member unit in its Washington field office devoted 
exclusively to solving computer crimes. 


he special team, which includes computer scientists, electrical engineers and 
experienced computer system operators, first handled the tip that led to the 
indictment of the five hackers in New York, according to agent James C. Settle, 
who directs the unit. 


Computer criminals, often equipped with relatively unsophisticated Commodore 64 
or Apple II computers, first crack into international telephone switching 
networks to make fr telephone calls anywhere in the world, Mr. Settle said. 


Hackers then can spend up to 16 hours a day, seven days a week, breaking into 
national and international computer networks such as the academic-oriented 
Internet, the National Aeronautics and Space Administration’s Span-Net and the 
Pentagon’s Milnet. 


To prevent being detected, unauthorized computer users "loop and weave" through 
computer networks at various locations in the process of getting information. 


"A lot of it is clearly for curiosity, the challenge of breaking into systems," 
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Mr. Settle said. "The problem is that they can take control of the system." 


Also, said Mr. Owens, computer hackers who steal such information from 
commercial data banks may turn to extortion as a way to make money. 


Mr. Settle said there are also "indications" that computer criminals are 
getting involved in industrial espionage. 


The five hackers indicted in New York on conspiracy, computer-fraud, computer 
tampering, and wire-fraud charges called themselves "MOD," for Masters of 
Deception or Masters of Disaster. 


The hackers were identified in court papers as Julio Fernandez, 18, John Lee, 
21, Mark Abene, 20, Elias Ladopoulos, 22, and Paul Stira, 22. All live in the 
New York City area. 


Mr. Fernandez and Mr. L intercepted data communications from a computer 
network operated by the Bank of America, court papers said. 


They also penetrated a computer network of the Martin Marietta Electronics 
Information and Missile Group, according to the court documents. 

The hackers obtained personal information stored in credit bureau computers, 
with the intention of altering it "to destroy people’s lives or make them look 
like saints," the indictment stated. 


And Today’s Password Is... May 26, 1992 


By Robert Matthews (The Daily Telegraph) (page 26) 
"Ways Of Keeping Out The Determined Hacker" 


One of the late Nobel Prize-winning physicist Richard Feynman’s favorite 
stories was how he broke into top-secret atomic bomb files at Los Alamos by 
guessing that the lock combination was 271828, the first six digits of the 
mathematical constant "e". Apart from being amusing, Feynman’s anecdote stands 
as a warning to anyone who uses dates, names or common words for their computer 
password. 


As Professor Peter Denning, of George Mason University, Virginia, points out in 
American Scientist, for all but the most trivial secrets, such passwords simply 
aren’t good enough. Passwords date back to 1960, and the advent of time- 
sharing systems that allowed lots of users access to files stored on a central 
computer. It was not long before the standard tricks for illicitly obtaining 
passwords emerged: Using Feynman-styl ducated guessing, standing behind 
computer users while they typed in their password or trying common system 
passwords like "guest" or "root". The biggest security nightmare is, however, 
the theft of the user-password file, which is used by the central computer to 
check any password typed in. 


By the mid-1970s, ways of tackling this had been developed. Using so-called 
"one-way functions", each password was encrypted in a way that cannot be 
unscrambled. The password file then contains only apparently meaningless 
symbols, of no obvious use to the would-be hacker. But, as Denning warns, even 
this can be beaten if passwords are chosen sloppily. Instead of trying to 
unscramble the file, hackers can simply feed common names and dates -- or even 
the entire English dictionary -- through the one-way function to see if the end 
result matches anything on the scrambled password file. Far from being a 
theoretical risk, this technique was used during the notorious Project 
Equalizer case in 1987, when KGB-backed hackers in Hanover broke the passwords 
of Unix-based computers in America. 


Ultimately, the only way to solve the password problem is to free people of 
their fear of forgetting more complex ones. The long-term solution, says 
Denning, probably lies with the use of smart-card technology. One option is a 
card which generates different passwords once a minute, using a formula based 
on the time given by an internal clock. The user then logs on using this 
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password. Only if the computer confirms that the password corresponds to the 
log-on time is the user allowed to continue. Another smart-card technique is 
the "challenge-response" protocol. Users first log on to their computer under 
their name, and are then "challenged" by a number appearing on the screen. 
Keying this into their smart card, a "response number" is generated by a 
formula unique to each smart card. If this number corresponds to the response 
expected from a particular user’s smart card, the computer allows access. A 
number of companies are already marketing smart-card systems, although the 
technology has yet to become popular. 


In the meantime, Denning says that avoiding passwords based on English words 
would boost security. He highlights one simple technique for producing non- 
standard words that are nonetheless easy to remember: "Pass-phrases". For 
this, one merely invents a nonsensical phrase like "Martin says Unix gives gold 
forever", and uses the first letter of each word to generate the password: 
MSUGGF. Such a password will defeat hackers, even if the password file is 
stolen, as it does not appear in any dictionary. However, Denning is wary of 
giving any guarantees. One day, he cautions, someone may draw up a 
computerized dictionary of common phrases. "The method will probably be good 
for a year or two, until someone who likes to compile these dictionaries starts 
to attack it." 


Outgunned "Computer Cops" Track High-Tech Criminals June 8, 1992 


By Tony Rogers (Associated Press) 


BOSTON -- The scam was simple. When a company ordered an airline ticket on its 
credit card, a travel agent entered the card number into his computer and 
ordered a few extra tickets. 


The extra tickets added up and the unscrupulous agent sold them for thousands 
of dollars. 


But the thief eventually attracted attention and authorities called in Robert 
McKenna, a prosecutor in the Suffolk County district attorney’s office. He is 
one of a growing, but still outgunned posse of investigators who track high- 
tech villains. 


After the thief put a ticket to Japan on a local plumbing company’s account, he 
was arrested by police McKenna had posing as temporary office workers. He was 
convicted and sentenced to a year in prison. 


But the sleuths who track high-tech lawbreakers say too many crimes can be 
committed with a computer or a telephone, and too few detectives are trained to 
stop them. 


"What we’ve got is a nuclear explosion and we’re running like hell to escape 
the blast. But it’s going to hit us," said Chuck Jones, who oversees high-tech 
crime investigations at the California Department of Justice. 


The problem is, investigators say, computers have made it easier to commit 
crimes like bank fraud. Money transfers that once required signatures and 
paperwork are now done by pressing a button. 


But it takes time to train a high-tech enforcer. 


"Few officers are adept in investigating this, and few prosecutors are adept 
in prosecuting it," Jones said. 


"You either have to take a cop and make him a computer expert, or take a 
computer expert and make him a cop. I’m not sure what the right approach is." 


In recent high-tech crimes: 


— Volkswagen lost almost $260 million because of an insider computer scam 
involving phony currency exchange transactions. 


14.txt Wed Apr 26 09:43:39 2017 11 


- A former insurance firm employee in Fort Worth, Texas, deleted more than 
160,000 records from the company’s computer. 


- A bank employ sneaked in a computer order to Brinks to deliver 44 
kilograms of gold to a remote site, collected it, then disappeared. 


Still, computer cops have their successes. 


The Secret Service broke up a scheme to make counterfeit automatic teller 
machine cards that could have netted millions. 


And Don Delaney, a computer detective for the New York State Police, nabbed 
Jaime Liriano, who cracked a company’s long-distance phone system. 


Many company phone systems allow employes to call an 800 number, punch in a 
personal identification number and then make long-distance calls at company 
expense. 


Some computer hackers use automatic speed dialers -- known as "demon dialers" 
-- to dial 800 numbers repeatedly and try different four-digit numbers until 
they crack the ID codes. Hackers using this method stole $12 million in phone 
service from NASA. 


Liriano did it manually, calling the 800 number of Data Products in 
Wallingford, Connecticut, from his New York City apartment. He cracked the 
company’s code in two weeks. 


Liriano started selling the long distance service -- $10 for a 20-minute call 
anywhere -- and customers lined up inside his apartment. 


But Delaney traced the calls and on March 10, he and his troopers waited 
outside Liriano’s apartment. On a signal from New York Telephone, which was 
monitoring Liriano’s line, the troopers busted in and caught him in the act. 


Liriano pleaded guilty to a misdemeanor of theft of services, and was 
sentenced to three years’ probation and community service. 


Data Products lost at least $35,000. "And we don’t know what he made," 
Delaney said of Liriano. 


Who Pays For Calls By Hackers? June 12, 1992 


By Kent Gibbons (The Washington Times) (Page C1) 


ICF International Inc. doesn’t want to pay $82,000 for unauthorized calls by 
hackers who tapped the company’s switchboard. 


AT&T says the Fairfax engineering firm owns the phone system and is responsible 
for the calls, mostly to Pakistan. 


Now their dispute and others like it are in Congress’ lap. A House 
subcommittee chairman believes a law is needed to cap the amount a company can 
be forced to pay for fraudulent calls, the same way credit card users are 
protected. 


Edward Markey, the Massachusetts Democrat who held hearings on the subject 
said long-distance carriers and local telephone companies should absorb much of 
those charges. 


Victims who testified said they didn’t know about the illegal calls until the 
phone companies told them, sometimes weeks after strange calling patterns 
began. But since the calls went through privately owned switchboards before 
entering the public telephone network, FCC rules hold the switchboard owners 
liable. 


"This is one of the ongoing dilemmas caused by the breakup of AT&T," Mr. Markey 
said. Before the 1984 Bell system breakup, every stage of a call passed 
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through the American Telephone & Telegraph Co. network and AT&T was liable for 
fraudulent calls. 


Estimates of how much companies lose from this growing form of telephone fraud 
range from $300 million to more than $2 billion per year. 

The range is so vast because switchboard makers and victims often don’t report 
losses to avoid embarrassment or further fraud, said James Spurlock of the 
Federal Communications Commission. 


Long-distance carriers say they have stepped up their monitoring of customer 
calls to spot unusual patterns such as repeated calls to other countries in a 
short period. In April, Sprint Corp. added other protective measures, 
including, for a $100 installation charge and $100 monthly fee, a fraud 
liability cap of $25,000 per incident. 


AT&T announced a similar plan last month. 


Robert Fox, Sprint assistant vice president of security, said the new plans cut 
the average fraud claim from more than $20,000 in the past to about $2,000 
during the first five months of this year. 


But the Sprint and AT&T plans don’t go far enough, Mr. Markey said. 
ICF’s troubles started in March 1988. At the time, the portion of ICF that was 


hit by the fraud was an independent software firm in Rockville called Chartways 
Technologies Inc. ICF bought Chartways in April 1991. 


As with most cases of fraud afflicting companies with private phone systems, 
high-tech bandits broke into the Chartways switchboard using a toll-free number 
set up for the company’s customers. 


Probably aided by a computer that randomly dials phone numbers, the hackers 
got through security codes to obtain a dial tone to make outside calls. 


The hackers used a fairly common feature some companies offer out-of-town 
employees to save on long-distance calls. MIronically, Chartways never used th 
feature because it was too complicated, said Walter Messick, ICF’s manager of 
contract administration. 


On March 31, AT&T officials told Chartways that 757 calls were made to Pakistan 
recently, costing $42,935. 


The phone bill arrived later that day and showed that the Pakistan calls had 
begun 11 days before, Mr.Messick said. 


Because of the Easter holiday and monitoring of calls by Secret Service agents, 
ICF’s outside-calling feature was not disconnected until April 4. By then, ICF 
had racked up nearly $82,000 in unauthorized calls. 


A year ago, the FCC’s Common Carrier Bureau turned down ICF’s request to erase 
the charges. The full commission will hear an appeal this fall. 


Dutch Hackers Feel Data Security Law Will Breed Computer Crime July 7, 1992 


By Oscar Kneppers (ComputerWorld Netherland) 


HAARLEM, the Netherlands -- Dutch hackers will be seriously reprimanded for 
breaking and entering computer systems, if a new law on computer crime is 
passed in the Netherlands. 


Discussed recently in Dutch parliament and under preparation for more than two 
years, the proposed law calls hacking "a crime against property." It is 
expected to be made official in next spring at the earliest and will consist of 
the following three parts: 


- The maximum penalty for hackers who log on to a secured computer system 
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would be six months’ imprisonment. 


- If they alter data in the system, they could spend up to four years in 
prison. 


- Those who illegally access a computer system that serves a "common use" —-— 
like that in a hospital or like a municipal population database -- could soon 
risk a prison sentence of six years. 


This pending law does not differentiate between computer crimes committed 
internally or externally from an office. For example, cracking the password of 
a colleague could lead to prosecution. 


Hackers believe this law will only provoke computer crime, because the hackers 
themselves will no longer offer "cheap warnings" to a computer system with poor 
security. 


Rop Gonggrijp, who is sometimes called the King of Hacking Holland, and is 
currently editor-in-chief of Dutch computer hacker magazine "Hack-tic" warns 
that this law could produce unexpected and unwanted results. 


"Students who now just look around in systems not knowing that it [this 
activity] is illegal could then suddenly end up in jail," he said. Gonggrijp 
equates hacking to a big party, where you walk in uninvited. 


Gonggrijp is concerned about the repercussions the new law may have on existing 
hackers. He said he thinks the current relationship between computer hackers 
and systems managers in companies is favorable. "[Hackers] break into, for 
example, an E-mail system to tell the systems manager that he has to do 
something about the security. If this law is introduced, they will be more 
careful with that [move]. The cheap warning for failures in the system will, 
therefore, no longer take place, and you increase chances for so-called real 
criminals with dubious intentions," he added. 


According to a spokesman at the Ministry of Justice in The Hague, the law gives 
the Dutch police and justice system a legal hold on hackers that they currently 
lack. 


"Computer criminals [now] have to be prosecuted via subtle legal tricks and 
roundabout routes. A lot of legal creativity was [previously] needed. But 
when this law is introduced, arresting the hackers will be much easier," he 
said. 


The Dutch intelligence agency Centrale Recherche Informatiedienst (CRI) in The 
Hague agreed with this. Ernst Moeskes, CRI spokesman, said, "It’s good to see 
that we can handle computer crime in a directed way now." 


PWN Quicknotes 

1. Printer Avoids Jail In Anti-Hacking Trial (By Melvyn Howe, Press 
Association Newsfile, June 9, 1992) -- A printer avoided a jail sentence 

in Britain’s first trial under anti-hacking legislation. Freelance 
typesetter Richard Goulden helped put his employers out of business with a 
pirate computer program because he said they owed him L2,275 in back 
pay. Goulden, 35, of Colham Avenue, Yiewsley, west London, was 
conditionally discharged for two years after changing his plea to guilty on 
the second day of the Southwark Crown Court hearing. He was ordered to pay 
L1,200 prosecution costs and L1,250 compensation to the company’s 
liquidators. Goulden had originally denied the charge of unauthorized 
modification of computer material under the 1990 Computer Misuse Act. 

After his change of plea Judge John Hunter told him: "I think it was plain 
at a very early stage of these proceedings that you had no defence to this 
allegation." Mr. Warwick McKinnon, prosecuting, told the jury Goulden added 
a program to a computer belonging to Ampersand Typesetters, of Camden, 
north-west London, in June last year which prevented the retrieval of 
information without a special password. Three months later the company 
"folded". Mr Jonathan Seitler, defending, said Goulden had changed his 
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plea after realizing he had inadvertently broken the law. 


2. ICL & GM Hughes In Joint Venture To Combat Computer Hackers (Extel Examiner, 
June 15, 1992) -- General Motors Corporation unit, Hughes STX, and ICL have 
set up a joint venture operation offering ways of combating computer 
hackers. Hughes STX is part of GM’s GM Hughes Electronics Corporation 
subsidiary. ICL is 80% owned by Fujitsu. Industry sources say the venture 
could reach $100 million in annual sales within four years. 


3. Another Cornell Indictment (Ithaca Journal, June 17, 1992) -- Mark Pilgrim, 
David Blumenthal, and Randall Swanson -- all Cornell students hav ach 
been charged with 4 felony counts of first-degree computer tampering, 1 
count of second-degree computer tampering, and 7 counts of second-degree 
attempted computer tampering in connection with the release of the MBDF 
virus to the Internet and to various BBSs. 


David Blumenthal has also been charged with two counts of second-degree 
forgery and two counts of first-degree falsifying business records in 
connection with unauthorized account creation on Cornell’s VAX5 system. He 
was also charged with a further count of second-degree computer tampering 
in connection with an incident that occurred in December of 1991. 


4. Computer Watchdogs Lead Troopers To Hacker (PR Newswire, July 17, 1992) —-- 
Olympia, Washington -- State Patrol detectives served a search warrant at an 

East Olympia residence Thursday evening, July 16, and confiscated a personal 

computer system, programs and records, the Washington State Patrol said. 


The resident, who was not on the premises when the warrant was served, is 
suspected of attempts to break into computer files at the Department of 
Licensing and the State Insurance Commissioner’s office. 


The "hacker’s" attempts triggered computerized security devices which 
alerted officials someone was attempting to gain access using a telephone 
modem. Patrol detectives and computer staff monitored the suspect’s 
repeated attempts for several weeks prior to service of the warrant. 


Placement of a telephone call by a non-recognized computer was all that was 
required to trigger the security alert. The internal security system then 

stored all attempted input by the unauthorized user for later retrieval and 
use by law enforcement. Integrity of the state systems was not breached. 


The investigation is continuing to determine if several acquaintances may be 
linked to the break in. Charges ar xpected to be filed as early as next 
week in the case. 


CONTACT: Sgt. Ron Knapp of the Washington State Patrol, (206) 459-6413 


5. UPI reports that the 313 NPA will split to a new 810 NPA effective 
August 10, 1994. 


Oakland, Macomb, Genesee, Lapeer, St. Clair and Sanilac counties as well as 
small sections of Saginaw, Shiawassee and Livingston counties will go into 
810. Wayne, Washtenaw, Monroe, and small parts of Jackson and Lenawee 
counties will remain in 313. The city of Detroit is in Wayne County and 
won’t change. 


